# Check Point

> Protect Check Point remote access VPN with Ironchip over RADIUS, using an NPS server for domain users or the Ironchip RADIUS server for Check Point users.

URL: https://docs.ironchip.com/en/identidad/integraciones/red/check-point/

This guide explains how to protect **Check Point** remote access with Ironchip authentication over [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/). There are two RADIUS server options, and the Check Point configuration is the same for both: an [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/) server for domain users (Active Directory) or the [Ironchip RADIUS server](https://docs.ironchip.com/en/identidad/integraciones/red/radius-server/) for Check Point users.

## Requirements

- For domain users (Active Directory): an [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/) server with the Ironchip plugin.
- For Check Point users: the [Ironchip RADIUS server](https://docs.ironchip.com/en/identidad/integraciones/red/radius-server/) installed and an API key application configured.
- Access to the Check Point **Smart Console**.

## Architecture

Check Point base scenario:

[Image: Diagram of the Check Point base scenario without Ironchip]

Integration with Ironchip:

[Image: Diagram of the Check Point integration with Ironchip]

## Configure Check Point

### Create the host

1. Open the Check Point **Smart Console**.

   [Image: Check Point Smart Console main screen]

2. In the upper right, click **New** and select **Host**.

   [Image: New menu with the Host option]

3. Enter a name for the host in **Enter Object Name** and, in **IPv4 address**, the IP of the computer where the RADIUS server runs (the NPS server or the Ironchip RADIUS server). Click **OK**.

   [Image: Host creation window with name and IP]

   The host is created.

   [Image: Host created in the Smart Console]

### Create the RADIUS service

1. In the search bar in the upper right, search for **RADIUS** and clone the protocol in the **UDP service** section. This creates a new RADIUS service with the properties that enable access.
2. On the **General** tab, give the service a name (for example, `Ironchip_Protected_Protocol`), check that the **protocol** and **port** match those of your RADIUS server and click **OK**.

   [Image: General properties of the RADIUS service: name, protocol and port]

3. On the **Advanced** tab, under **Virtual session timeout**, select **Specific** with the value `60`, leave **Enable aggressive aging** cleared and click **OK**.

   [Image: Advanced tab of the UDP service with Virtual session timeout set to 60 seconds]

### Create the RADIUS server

1. With the host and the service created, create a RADIUS server: in the upper right, go to **New > More > Server > RADIUS...**.

   [Image: Creating a new RADIUS server]

2. Give it a descriptive name and configure it in the next window. In this example it is called `NPS_IRONCHIP_RADIUS`.

   [Image: Configuration of the NPS_IRONCHIP_RADIUS RADIUS server]

   - **Host**: the host created in the first step.
   - **Service**: the service created in the previous step.
   - **Shared secret**: a secure string that must match the one configured in NPS or in the Ironchip RADIUS server.
   - **Protocol**: `PAP`.

3. Click **OK**.

### Configure Mobile Access

Create an **External User Profile**, which you need to authenticate users who are not registered internally in Check Point.

1. On the Smart Console main page, in the left menu, go to **Manage & Settings > Mobile Access** and click **Configure in SmartDashboard...**.

   [Image: Enabling Mobile Access in Manage & Settings]

2. In SmartDashboard, in the **Users** pane at the lower left, create a new **External User Profile**. Set its parameters according to your domain and click **OK**.

   [Image: External User Profile]

3. Create a group for the domain users. In the upper right, go to **New > More > User/Identity > User Group**.

   [Image: New > More > User/Identity > User Group menu]

4. Give it a descriptive name and click the **+** icon.

   [Image: User group window with the + button]

5. Click **All**, then **External User Profiles**, and select the profile you created.

   [Image: All list with the External User Profiles option]

   [Image: Selecting the external profile you created]

### Configure the security policies

1. Go to **Security Policies > VPN Communities**, right-click **Remote Access** and select **Edit**.

   [Image: Remote Access context menu in VPN Communities]

2. On the **Participating Gateways** tab, click **+** and select your firewall.

   [Image: Participating Gateways tab with the firewall selected]

3. On the **Participant User Groups** tab, click **+** and select the group you created.

   [Image: Participant User Groups tab with the group selected]

4. On the main screen, open the gateway that has the VPN configured and, in the left pane, select **VPN Clients > Authentication**.
5. Click **Add** and then **New**, select the type and click **OK**.
6. In the **Login Option** settings, enter a name (for example, `NPS_IRONCHIP_ACCESS` or `RADIUS_IRONCHIP_ACCESS`). You can also fill in **Comment** and **Display Name**, which is the name shown on the initial screen. Click **OK**.
7. In **Authentication Methods**, click **Add**, select **RADIUS** as the method and choose the RADIUS server you created. Click **OK**.
8. In **User Directories**, select **Manual configuration** and enable authentication only for **External user profiles**.

### Adjust the global properties

1. In the upper left, click **Global Properties**.

   [Image: Global Properties in the Smart Console]

2. Go to the last section, **Advanced**, and click **Configure**.

   [Image: Advanced section with the Configure button]

3. Expand **Firewall-1**, click **Authentication** and set `au_connect_timeout` to `60`.

   [Image: au_connect_timeout parameter set to 60 under Authentication]

4. Click **RADIUS**, set `radius_retrant_num` to `1` and `radius_retrant_timeout` to `60`.

   [Image: radius_retrant_num and radius_retrant_timeout parameters]

## Verify the integration

When everything is configured, test authentication from the VPN client with a user who has access. Choose the login option you created (it appears with its **Display Name**) and enter your credentials: you are then asked to authenticate with Ironchip.

## Troubleshooting

- **Authentication fails because it times out**: Ironchip waits for the user to respond, so the timeouts must be long. Check `Virtual session timeout` (`60`), `au_connect_timeout` (`60`), `radius_retrant_timeout` (`60`) and `radius_retrant_num` (`1`).
- **The RADIUS server rejects the request**: check that the shared secret is the same in Check Point and in NPS or the Ironchip RADIUS server, and that the RADIUS server host has the correct IP.