Create a Radius Logon Procedure

  1. Login to the DualShield Administration Console
  2. Navigate to “Authentication | Logon Procedures”
  3. Click the “+ CREATE” button on the toolbar
  4. Enter a friendly “Name” and select “RADIUS” as the Type



  5. Click “SAVE” to create.
  6. Click the context "..." menu on the newly create Logon Procedure. Select “Logon Steps”
  7. In the popup windows, click the “+ ADD” button on the toolbar, to add Logon Step(s)
  8. Select “Static Password” (AD account) as the first Step. Add your preferable authenticator as your Second step. "One-Time Password" for example.

Create a RADIUS application

  1. Navigate to “Authentication | Applications”
  2. Click the “+ CREATE” button on the toolbar
  3. Enter a friendly “Name”
  4. Select your internal AD “Realm”
  5. Select the Logon Procedure created in the previous Step,

     

  6. Click “SAVE” to create.
  7. Click the context "..." menu of the newly created Application, then select “Agents”
  8. Select the integrated DualShield Radius Server Agent, e.g:

     

  9. Click “SAVE” to confirm.
  10. Finally click the context "..." menu of the newly created Application, select “Self Test”

Register the CheckPoint Service Provider as a Radius Client

Navigate to "Radius | Radius Clients” in DualShield Administration console. Click the “+ CREATE" button on the toolbar. Enter the credentials like follows:                              

Name                                         Enter a name for this Radius Client
Radius Server                             Select integrated DualShield Radius Server
Application                                Select the CheckPoint Application created previously
IP Address                                 The IP address of the CheckPoint Security Gateway 
Shared Secret                            Provide the shared secret phrase used to communicate between Radius Client and Service Provider Radius configuration.
Authentication Protocols          Select communication protocols for Radius server and Radius client

         

Finally click "SAVE" to complete.

Check Point only recognises RADIUS attributes from 1 to 63 defined within RFC 2138. Tick "Do not reply with Message Authenticator (Attribute 80)" so that DualShield Radius server will not return attribute 80.