:orphan:

******************************************
Checkpoint Mobile Access Blade Integration
******************************************

"""""""""
Overview
"""""""""

Swivel can provide strong and two factor authentication to the Check Point Mobile Access Blade. This document outlines the details required to carry this out.

"""""""""""""""""""
Baseline
"""""""""""""""""""

Swivel 3.x

Check Point CR75 Mobile Access Blade and newer

""""""""""""""
Prerequisites
""""""""""""""

Working Mobile Access Blade VPN

Swivel 3.x

Use of the `TURing <https://kb.swivelsecure.com/w/index.php/Single_Channel_How_To_Guide>`_, will require the use of a NAT.

When a Swivel appliance VIP is used, the real IP address should be used and not the VIP. For redundancy select Primary and Secondary RADIUS servers, see `VIP on PINsafe Appliances <https://kb.swivelsecure.com/w/index.php/VIP_on_PINsafe_Appliances>`_.

"""""""""""""""""""""
Downloads
"""""""""""""""""""""

`Customised login page <https://kb.swivelsecure.com/wiki/images/9/98/CheckpointMobileAccessBladeLoginPage.zip>`_

""""""
Demos
""""""

.. raw:: html
    
    <div class="embedvideo autoResize autoResized" style="width: 288px;"><div class="embedvideowrap" style="width: 288px; height: 164.429px;" width="288" height="164.42906574394465"><iframe src="92946062.html" width="288" height="164.42906574394465" frameborder="0" allowfullscreen="true" data-orig-height="166" data-orig-width="290" style="width: 288px; height: 164.429px;"></iframe></div></div>
    <video controls src="video/Meeting01.mp4" width="400" height="400"/>

















==============================
Configuring the RADIUS server
==============================

On the Swivel Administration console configure the RADIUS Server and NAS, see `RADIUS Configuration <https://kb.swivelsecure.com/w/index.php/RADIUS_Configuration>`_

========================================
Enabling Session creation with username
========================================

To allow the `TURing <https://kb.swivelsecure.com/w/index.php/TURing>`_ image, `Pinpad <https://kb.swivelsecure.com/w/index.php/Pinpad>`_ and other single channel images, under Server/Single Channel set `Allow session request by username <https://kb.swivelsecure.com/w/index.php/Allow_session_request_by_username>`_ to Yes.

=============================================
Setting up Swivel Dual Channel Transports
=============================================

See `Transport Configuration <https://kb.swivelsecure.com/w/index.php/Transport_Configuration>`_

"""""""""""""""""""""""
Connectra Configuration
"""""""""""""""""""""""

=============================================
Enabling RADIUS Authentication in Connectra
=============================================

You need to configure Swivel as an authentication server on the Connectra appliance.

* Open Smart Dashboard and log in.
* Under Network and Resources -> Hosts, configure the Swivel server as a new host. You just need to give it a name and add the IP address.
* Under Users and Authentication -> Authentication -> RADIUS Servers, create a new RADIUS server. Select Swivel as the host, “NEW-RADIUS” as the service, and enter the shared secret you previously set on the Swivel server. You can select RADIUS version 1 or 2, and PAP or MSChap as the protocol: Swivel will detect these protocols automatically. Note: When a Swivel appliance VIP is used, the real IP address should be used and not the VIP. For redundancy select Primary and Secondary RADIUS servers, see VIP on PINsafe Appliances.

You will also need to configure authentication for the relevant users. The simplest way to handle this is to create a new user group containing all users that will be using Swivel (if you do not already have one):

* Go to Users and Authentication -> Internal Users -> User Groups.
* Then under User Templates, create a new template, or modify an existing one, containing the relevant group, and set the authentication to RADIUS, using the Swivel server.

Don’t forget to save and install the policy once you have made all relevant changes.

==============================
Test the RADIUS authentication
==============================

At this stage it should be possible to authenticate by `SMS <https://kb.swivelsecure.com/w/index.php/SMS>`_, hardware `Token <https://kb.swivelsecure.com/w/index.php/Token>`_, `Mobile Phone Client <https://kb.swivelsecure.com/w/index.php/Mobile_Phone_Client>`_ and `Taskbar <https://kb.swivelsecure.com/w/index.php/Taskbar_How_to_Guide>`_ to verify that the RADIUS authentication is working for users. Browse to the SSL VPN login page, and enter Username and if being used, the password. From the Swivel Administration console select User Administration and the required user then `View Strings <https://kb.swivelsecure.com/w/index.php/View_Security_Strings_How_To_Guide>`_, and select an appropriate authentication string or OTC for the user. At the SSL VPN login enter the required OTC. Check the Swivel logs for a RADIUS success or rejected message. If no RADIUS message is seen, check that the Swivel RADIUS server is started and that the correct ports are being used.

""""""""""""""""""""""""""""""""""""
Customising the Connectra Login Page
""""""""""""""""""""""""""""""""""""

**NOTE:** it is assumed here that you are familiar with Unix commands, in particular with the vi editor, as you will need to edit a file.

**NOTE:** There is an example `LoginPage.php <https://kb.swivelsecure.com/wiki/images/3/35/ConnectraLoginPage.zip>`_ available which is the Login.php file with the modifications already included. This can be used for reference but may not be 100% suitable for specific installations and different Connectra versions.

=========================
Login to the Connectra
=========================

To modify the Connectra login page, you need to log into the console, either physically on the appliance, or using a SSH terminal server such as Putty see `PuTTY How To Guide <https://kb.swivelsecure.com/w/index.php/PuTTY_How_To_Guide>`_. Switch into expert mode.

=============================
Locate the file LoginPage.php
=============================

Change directory to /opt/CPcvpn-R66/phpincs (note: the exact directory name CPcvpn-R** will vary depending on the Connectra revision number). Backup the file LoginPage.php by making a copy of it.

======================
Edit the LoginPage.php
======================

After making a backup copy, edit the file LoginPage.php.

First of all, search for the end of the page header, “</HEAD>”. There should be a “</script>” tag just before that. Insert the following just before the </script>:

.. code-block:: text

    function showTuring() {
        turing = document.getElementById("imgTuring");
        username = document.getElementById("userName").value;
        turing.src = "https://pinsafe_server:8443/proxy/SCImage?username=" +username + "&random=" + Math.floor(Math.random()*100000);
        turingRow = turing.parentNode.parentNode;
        turingRow.style.display = "";
    }

NOTE: you should replace "pinsafe_server" in the value of turing.src above with the actual internet-visible address of the Swivel instance.

For a Swivel virtual or hardware appliance: "`https://pinsafe_server:8443/proxy/SCImage?username= <https://pinsafe_server:8443/proxy/SCImage?username=>`_"

For a software only install see `Software Only Installation <https://kb.swivelsecure.com/w/index.php/Software_Only_Installation>`_


Now locate the input field with ID “userName”.

Add the following attribute to the field: onblur="showTuring();". The complete line should appear as follows:

.. code-block:: text

    <input type="text" id="userName" name="userName" class="inputText" autocomplete="off" <?=$User_Read_Only?> style="<?=$User_Style_Var?>" value="<?=$userName?>" onblur="showTuring();">

Look for the second <tr> tag after this field. Insert the following before this tag:

.. code-block:: text

    <tr style="display:none"><td colspan="2" align="center">
    <input type="button" value="<?= TURING ?>" onclick="showTuring();"><br>
    <img src="" id="imgTuring" alt="<?= TURING ?>">
    </td></tr>

You can now save the file.

============================
Editing the password prompt
============================

If you want to change the prompt for the password (e.g to prompt for One-Time Code), or to change the text displayed on the button that requests a new `TURing <https://kb.swivelsecure.com/w/index.php/TURing>`_ image, you will need to edit the file Strings.en_US.php, or the appropriate Strings file for your local language (type ls Strings* to see what files are available). Locate the string “PASSWORD”, and change the text within the quotes to the right of the => symbol to “OTC”, or whatever you prefer.

To set the text displayed on the `TURing <https://kb.swivelsecure.com/w/index.php/TURing>`_ image button, insert a new line after this line, with the following content:

"TURING" => "TURing",

You can replace the right-hand text with anything you prefer. Don’t forget the comma at the end of the line.

""""""""
Testing
""""""""

With the changes in place, when a user accesses the Connectra portal the will see the modified login page.

.. image:: /images/Integration/RADIUS/Checkpoint_Connectra_Integration/ConnectraSignin.png

After entering their username and either tabbing away from the username field of clicking the TURing button they will be presented with a TURing image. The PINsafe log should record a session start for that user.

The user can then use their PIN to extract their one-time code and enter this to authenticate. The PINsafe log show record the RADIUS dialogue associated with this authentication.

""""""""""""""""
Troubleshooting
""""""""""""""""

Check the Swivel logs for Turing images and RADIUS requests.

`Image from PINsafe server absent <https://kb.swivelsecure.com/w/index.php/Image_from_PINsafe_server_absent>`_