Creating an Administrator Account with RADIUS Server Authentication

Remote Authentication Dial-In User Service (RADIUS) is an external authentication method that provides security and scalability by separating the authentication function from the access server. With RADIUS, the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. forwards the authentication requests to the RADIUS server. The RADIUS server, which stores administrator account information, does the authentication. The RADIUS protocol uses UDP to communicate with the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. or the Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server...

To configure RADIUS server authentication for an administrator

1. In SmartConsole, configure a new RADIUS server object

   1. Go to the Object Explorer and select New > More > Server > RADIUS.

   2. Give the server a Name. It can be any name.

   3. In the Host field, click the drop-down arrow, click New and create a New Host with the IP address of the RADIUS server.

   4. Click OK.

      This host now appears in the Host field of the New RADIUS window.

   5. In the Shared Secret field, type the secret key that you defined previously on the RADIUS server.

   6. Click OK.

   7. Publish the SmartConsole session.

2. Create a new administrator and define RADIUS as the authentication method

   1. Go to Manage & Settings > Permissions & Administrators > Administrators > Click New.

      The New Administrator window opens.

   2. Give the administrator the name that is defined on the RADIUS server.

   3. In Authentication method, select RADIUS.

   4. Select the RADIUS Server defined earlier.

   5. Optional: In the Authentication section > Certificate Information, click Create:

      1. Enter a password.

      2. Click OK.

      3. Save the certificate file to a secure location on the SmartConsole computer:

         Notes: Make sure that the login name is included in the File name field. Make sure that Certificate Files (*p12) is selected in the Save as type drop-down list. The certificate file is in the PKCS #12 format, and has a .p12 extension. A password is required to protect the sensitive data in the certificate file. The certificate file contains the private key. After the certificate is issued, save it to a file and give the administrator this file and password. The administrator can then authenticate with the certificate when they log in with SmartConsole to the Security Management Server.

   6. Assign a Permission Profile.

      See Assigning Permission Profiles to Administrators.

   7. In the Expiration section, select the expiration date and make sure that it is set to a valid future date.

   8. Click OK.

   9. Publish the SmartConsole session.

3. Optional: Configure a RADIUS server group for SmartConsole administrator authentication

   1. In SmartConsole, configure all the servers that you want to include in the server group, as explained in To configure RADIUS server authentication for an administrator.

      For each server, enter its priority in the group. The lower the number is, the higher the priority.

      For example, if you create a group with 3 servers, with priorities 1,2 and 3, the server with number 1 is approached first, the server with number 2 second, and the server with number 3, third.

   2. Create the server group: In SmartConsole, go to Object Explorer and click New > Server > More > RADIUS Group.

   3. Configure the group properties and add servers to the group:

      1. Give the group a Name. It can be any name.

      2. Click the plus (+) for each server you want to add, and select each server from the drop-down list.

      3. Click OK.

      4. Publish the SmartConsole session.

4. Optional: Import the certificate file into the Windows Certificate Store

   Note - This procedure applies if you create a certificate authentication in the administrator object, and you log in to SmartConsole with the CAPI Certificate option.

   1. Right-click the *.p12 file you saved when you created the required administrator, and click Install PFX.

      The Certificate Import Wizard opens.

   2. In the Store Location section, select the applicable option:

      • Current User (this is the default)

      • Local Machine

   3. Click Next.

   4. Enter the same certificate password you used when you created the required administrator certificate.

   5. Clear Enable strong private key protection.

   6. Select Mark this key as exportable.

   7. Click Next.

   8. Select Place all certificates in the following store, click Browse > Personal > OK.

   9. Click Next.

   10. Click Finish.