Account Units

An Account Unit represents branches of user information on one or more LDAP servers. The Account Unit is the interface between the LDAP servers and the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. and Security Gateways.

You can have a number of Account Units representing one or more LDAP servers. Users are divided among the branches of one Account Unit, or between different Account Units.

Note - When you enable the Identity AwarenessClosed Check Point Software Blade on a Security Gateway that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. and Mobile AccessClosed Check Point Software Blade on a Security Gateway that provides a Remote Access VPN access for managed and unmanaged clients. Acronym: MAB. Software BladeClosed Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. , SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. opens a First Time Configuration Wizard. The Active Directory Integration window of this wizard lets you create a new AD Account Unit. After you complete the wizard, SmartConsole creates the AD object and Account Unit.

Working with LDAP Account Units

Use the LDAP Account Unit Properties window in SmartConsole to create a new or to edit an existing Account Unit or to create a new one manually.

To create or edit an existing LDAP Account Unit:

    • Create: In the Objects tab, click New > More > User/Identity > LDAP Account unit.

    • Edit: In SmartConsole, open the Object Explorer (press the CTRL+E keys) > Users/Identities > LDAP Account Units > Right-click the LDAP Account Unit and select Edit.

    The LDAP Account Unit Properties window opens.

  2. Edit the settings in these tabs:

    • Configure how the Security Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. uses the Account Unit

      These are the configuration fields in the General tab:

      • Name - Name for the Account Unit

      • Comment - Optional comment

      • Color - Optional color associated with the Account Unit

      • Profile - LDAP vendor

      • Domain - Domain of the Active Directory servers, when the same user name is used in multiple Account Units (this value is also necessary for AD Query and SSO)

      • Prefix - Prefix for non-Active Directory servers, when the same user name is used in multiple Account Units

      • Account Unit usage - Select applicable options:

      • Enable Unicode support - Encoding for LDAP user information in non-English languages

      • Active Directory SSO configuration - Click to configure KerberosClosed An authentication server for Microsoft Windows Active Directory Federation Services (ADFS). SSO for Active Directory - Domain Name, Account Name, Password, and Ticket encryption method

    • Manage LDAP servers that are used by this Account Unit. You can add, edit, or delete LDAP server objects.

      To configure an LDAP server for the Account Unit

      1. To add a new server, click Add. To edit an existing one, select it from the table and click Edit.

        The LDAP Server Properties window opens.

      2. From the Host drop-down menu, select the server object.

        If necessary, create a new SmartConsole server object:

        1. Click New.

        2. In the New Host window opens, enter the settings for the LDAP server.

        3. Click OK.

      3. Enter the login credentials and the Default priority.

        Note - If you create the LDAP account unit to submit group queries, no special permissions are needed.

        If you create the LDAP account unit to submit Active Directory queries, you must have the permissions provided in sk93938.

      4. Select access permissions for the Check Point Gateways:

        • Read data from this server

        • Write data to this server

      5. In the Encryption tab, configure the optional SSL encryption settings. To learn about these settings, see the Help. Click ? or press F1 in the Encryption tab.

      6. Click OK.

      To remove an LDAP server from the Account Unit:

      1. Select a server from the table.

      2. Click Remove.

      If all the configured servers use the same login credentials, you can modify those simultaneously.

      To configure the login credentials for all the servers simultaneously:

      1. Click Update Account Credentials.

        The Update Account to All Servers window opens.

      2. Enter the login credentials.

      3. Click OK.

    • Configure the LDAP server for the Security Management Server to query and the branches to use

      Note - Make sure there is LDAP connectivity between the Security Management Server and the LDAP Server that holds the management directory.

      To configure LDAP query parameters:

      1. From the Manage objects on drop-down menu, select the LDAP server object.

      2. Click Fetch branches.

        The Security Management Server queries and shows the LDAP branches.

      3. Configure Branches in use:

        • To add a branch, click Add and in the LDAP Branch Definition window that opens, enter a new Branch Path

        • To edit a branch, click Edit and in the LDAP Branch Definition window that opens, modify the Branch Path

        • To delete a branch, select it and click Delete

      4. Select Prompt for password when opening this Account Unit, if necessary (optional).

      5. Configure the number of Return entries that are stored in the LDAP database (the default is 500).

    • Configure the authentication scheme for the Account Unit. These are the configuration fields in the Authentication tab:

      • Use common group path for queries - Select to use one path for all the LDAP group objects (only one query is necessary for the group objects)

      • Allowed authentication schemes - Select one or more authentication schemes allowed to authenticate users in this Account Unit - Check Point Password, SecurID, RADIUS, OS Password, or TACACS

      • Users' default values - The default settings for new LDAP users:

        • User template - Template that you created

        • Default authentication scheme - one of the authentication schemes selected in the Allowed authentication schemes section

      • Limit login failures (optional):

        • Lock user's account after - Number of login failures, after which the account gets locked

        • Unlock user's account after - Number of seconds, after which the locked account becomes unlocked

      • IKE pre-shared secret encryption key - Pre-shared secret key for IKE users in this Account Unit

  3. Click OK.

  4. Install the Access Control Policy.

Configuring LDAP query parameters

  1. From the Manage objects on drop-down menu, select the LDAP server object.

  2. Click Fetch branches.

    The Security Management Server queries and shows the LDAP branches.

  3. Configure Branches in use:

    • To add a branch, click Add and in the LDAP Branch Definition window that opens, enter a new Branch Path

    • To edit a branch, click Edit and in the LDAP Branch Definition window that opens, modify the Branch Path

    • To delete a branch, select it and click Delete

  4. Select Prompt for password when opening this Account Unit, if necessary (optional).

  5. Configure the number of Return entries that are stored in the LDAP database (the default is 500).

Modifying the LDAP Server

  1. On the LDAP Account Unit Properties > Servers tab, double-click a server.

    The LDAP Server Properties window opens.

  2. On the General tab, you can change:

  3. On the Encryption tab, you can change the encryption settings between Security Management Server / Security Gateways and LDAP server.

    If the connections are encrypted, enter the encryption port and strength settings.

    Note - User Directory connections can be authenticated by client certificates from a Certificate Authority (CA). To use certificates, the LDAP server must be configured with SSL strong authentication. See Authenticating with Certificates.

Account Units and High Availability

With User Directory replications for High Availability, one Account Unit represents all the replicated User Directory servers. For example, two User Directory server replications can be defined on one Account Unit, and two Security Gateways can use the same Account unit.

Item

Description

1

Security Management Server. Manages user data in User Directory. It has an Account Unit object, where the two servers are defined.

2

User Directory server replication.

3

Security Gateway. Queries user data and retrieves CRLs from nearest User Directory server replication (2).

4

Internet

5

Security Gateway. Queries user data and retrieves CRLs from nearest User Directory server replication (6).

6

User Directory server replication.

Setting High Availability Priority

With multiple replications, define the priority of each LDAP server in the Account Unit. Then you can define a server list on the Security Gateways.

Select one LDAP server for the Security Management Server to connect to. The Security Management Server can work with one LDAP server replication. All other replications must be synchronized for standby.

  1. Open the LDAP Account Unit Properties window.

  2. Open the Servers tab.

  3. Add the LDAP servers of this Account Unit in the order of the priority that you want.

Authenticating with Certificates

The Security Management Server and Security Gateways can use certificates to secure communication with LDAP servers. If you do not configure certificates, the management server, Security Gateways, and LDAP servers communicate without authentication.

  1. Close all SmartConsole windows connected to the Management Server.

  2. On each Account Unit, to which you want to authenticate with a certificate, set the ldap_use_cert_auth attribute to true:

    1. Connect with Database Tool (GuiDBEdit Tool) (see sk13009) to the Management Server.

    2. In the left pane, browse to Table > Managed Objects > servers.

    3. In the right pane, select the Account Unit object.

    4. In the bottom pane, search for the ldap_use_cert_auth attribute, and set it to true.

    5. Save the changes and close Database Tool (GuiDBEdit Tool).

  3. Connect with SmartConsole to the Management Server.

  4. Add a CA object:

    1. In the Object Explorer (F11), click New > More > Server > More > Trusted CA.

      The Certificate Authority Properties window opens.

    2. In Certificate Authority Type, select External Check Point CA.

    3. Set the other options of the CA.

  5. For all necessary network objects (such as Security Management Server, Security Gateway, Policy Server) that require certificate-based User Directory connections:

    1. On the IPSec VPN page of the network object properties, click Add in the Repository of Certificates Available list.

      Note - A management-only server does not have an IPSec VPNClosed Check Point Software Blade on a Security Gateway that provides a Site to Site VPN and Remote Access VPN access. page. The User Directory on a management-only server cannot be configured to authenticate to an LDAP server using certificates.

    2. In the Certificate Properties window, select the defined CA.

  6. Test connectivity between the Security Management Server and the LDAP Server.

    See Managing LDAP Information.