Account Units

An Account Unit represents branches of user information on one or more LDAP servers. The Account Unit is the interface between the LDAP servers and the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. and Security Gateways.

You can have a number of Account Units representing one or more LDAP servers. Users are divided among the branches of one Account Unit, or between different Account Units.

Note - When you enable the Identity AwarenessClosed Check Point Software Blade on a Security Gateway that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. and Mobile AccessClosed Check Point Software Blade on a Security Gateway that provides a Remote Access VPN access for managed and unmanaged clients. Acronym: MAB. Software BladeClosed Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. , SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. opens a First Time Configuration Wizard. The Active Directory Integration window of this wizard lets you create a new Active Directory Account Unit. After you complete the wizard, SmartConsole creates the Active Directory object and Account Unit.

Working with LDAP Account Units

Use the LDAP Account Unit Properties window in SmartConsole to create a new or to edit an existing Account Unit or to create a new one manually.

To create or edit an existing LDAP Account Unit:

    • Create: In the Objects tab, click New > More > User/Identity > LDAP Account unit.

    • Edit: In SmartConsole, open the Object Explorer (press the CTRL+E keys) > Users/Identities > go to the required LDAP Account Unit, right-click it and select Edit.

    The LDAP Account Unit Properties window opens.

  2. Edit the settings in these tabs:

    • Configure how the Security Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. uses the Account Unit

      These are the configuration fields in the General tab:

      • Name - Name of the Account Unit

      • Comment - Optional comment

      • Color - Optional color associated with the Account Unit

      • Profile - LDAP vendor

      • Domain - Domain of the Active Directory servers, when the same user name is used in multiple Account Units (this value is also necessary for AD Query and SSO)

      • Prefix - Prefix for non-Active Directory servers, when the same user name is used in multiple Account Units

      • Account Unit usage - Select applicable options:

      • Enable Unicode support - Encoding for LDAP user information in non-English languages

      • Active Directory SSO configuration - Click to configure KerberosClosed An authentication server for Microsoft Windows Active Directory Federation Services (ADFS). SSO for Active Directory - Domain Name, Account Name, Password, and Ticket encryption method

    • Manage LDAP servers that are used by this Account Unit. You can add, edit, or delete LDAP server objects.

      To configure an LDAP server for the Account Unit:

      1. To add a new server, click Add.

        To edit an existing one, select it from the table and click Edit.

        The LDAP Server Properties window opens.

      2. From the Host drop-down menu, select the server object.

      3. Optional: If necessary, create a new LDAP server object:

        1. Close the LDAP Server Properties window.

        2. In SmartConsole, go to the Object Explorer.

        3. Click New > Host.

        4. In the New Host window that opens, enter the settings for the LDAP server.

        5. Click OK.

        6. Reopen the LDAP Server Properties window > Servers, and select the newly created host.

      4. Fill in this information:

        • Port

        • Username

        • Login DN

        • Password

        • Default priority

        • Select access permissions for the Check Point Gateways:

          • Read data from this server

          • Write data to this server

        Note - If you create the LDAP account unit to submit group queries, you do not need any special permissions.

        If you create the LDAP account unit to submit Active Directory queries, you must have the permissions provided in sk93938.

      5. In the Encryption tab, you can configure LDAPS.

        Note - LDAPS is required for Active Directory integration on Windows Server 2025 and recommended for earlier versions.

        Configure these settings:

        1. Select Use Encryption (SSL) - Enables LDAPS.

        2. Encryption port - The LDAPS port is automatically populated. You can modify it as needed.

          Note - When you select Use Encryption (SSL), the Port field in the General tab is automatically greyed out, and only the Encryption port in the Encryption tab is used for LDAP communication.

        3. Click Fetch to retrieve this information:

          • Server Name - The subject of the LDAPS server certificate.

          • CA - Certificate of the root CA that signed the LDAPS server certificate.

            Note - If you renew or replace the LDAPS server certificate using the same CA and Server Name, Security Gateways version R82 or higher trust the new certificate automatically.

          • Server - Fingerprint of the LDAPS server certificate.

        4. Verify that the fetched information is correct.

        5. Optional: Select CRL check to have the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. verify that the server certificate is not revoked.

          Note - If you enable CRL check, you must make sure that the LDAPS server certificate contains a CRL Distribution Point extension of type HTTP, and that the Security Gateway can access this URL.

        6. Min/Max Encryption Strength - Use the default values provided:

          • Export for minimum encryption strength

          • Strong for maximum encryption strength

      6. Click OK.

      To remove an LDAP server from the Account Unit:

      1. Select a server from the table.

      2. Click Remove.

      If all the configured servers use the same login credentials, you can modify them simultaneously.

      To configure the login credentials for all servers simultaneously:

      1. Click Update Account Credentials.

        The Update Account to All Servers window opens.

      2. Enter the login credentials.

      3. Click OK.

    • Configure the LDAP server for the Security Management Server to query and the branches to use

      Note - Make sure there is LDAP connectivity between the Security Management Server and the LDAP Server that holds the management directory.

      To configure LDAP query parameters:

      1. From the Server to connect drop-down menu, select the LDAP server object.

      2. Click Fetch branches.

        The Security Management Server queries and shows the LDAP branches.

      3. Configure Branches in use:

        • To add a branch, click Add and in the LDAP Branch Definition window that opens, enter a new Branch Path

        • To edit a branch, click Edit and in the LDAP Branch Definition window that opens, modify the Branch Path

        • To delete a branch, select it and click Delete

      4. Select Prompt for password when opening this Account Unit if necessary (optional).

      5. Configure the number of Return entries that are stored in the LDAP database (the default is 500).

    • Configure the authentication scheme for the Account Unit. These are the configuration fields in the Authentication tab:

      • Use common group path for queries - Select to use one path for all the LDAP group objects (only one query is necessary for the group objects)

      • Allowed authentication schemes - Select one or more authentication schemes allowed to authenticate users in this Account Unit - Check Point Password, SecurID, RADIUS, OS Password, or TACACS

      • Users' default values - The default settings for new LDAP users:

        • User template - Template that you created

        • Default authentication scheme - One of the authentication schemes selected in the Allowed authentication schemes section

      • Limit login failures (optional):

        • Lock user's account after - Number of login failures, after which the account gets locked

        • Unlock user's account after - Number of seconds, after which the locked account becomes unlocked

      • IKE pre-shared secret encryption key - Pre-shared secret key for IKE users in this Account Unit

  3. Click OK.

  4. Install the Access Control Policy.

Account Units and High Availability

With User Directory replications for High Availability, one Account Unit represents all the replicated User Directory servers. For example, you can define two User Directory server replications on one Account Unit, and two Security Gateways can use the same Account unit.

Item

Description

1

Security Management Server - Manages user data in User Directory. It has an Account Unit object, where the two servers are defined.

2

User Directory server replication.

3

Security Gateway - Queries user data and retrieves CRLs from nearest User Directory server replication (2).

4

Internet

5

Security Gateway - Queries user data and retrieves CRLs from nearest User Directory server replication (6).

6

User Directory server replication.

Setting High Availability Priority

With multiple replications, define the priority of each LDAP server in the Account Unit. Then you can define a server list on the Security Gateways.

Select one LDAP server for the Security Management Server to connect to. The Security Management Server supports only one LDAP server replication. You must synchronize all other replications for standby purposes.

  1. Open the LDAP Account Unit Properties window.

  2. Open the Servers tab.

  3. Add the LDAP servers of this Account Unit in the required order of priority.