> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Check Point Security Gateway This procedure describes how to integrate Check Point Security Manager Gateway and Identity as a Service. The aim of this integration is to provide strong, second-factor authentication for your Check Point Security Manager Gateway using Identity as a Service. ## Supported authentication methods | Authentication method | Notes | Supported protocols | | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | | Password | Password authentication is a first-factor authentication with Identity as a Service's password feature. | PAP, MS-CHAP v2 | | RADIUS | RADIUS authentication is a first-factor authentication with a RADIUS server. | PAP, MS-CHAP v2 | | Grid | Two-step authentication only. | PAP, MS-CHAP v2 | | Token | Identity as a Service supports response-only tokens. One-step or two-step authentication (including token push authentication). **Note:** Challenge/response tokens are unsupported with MSCHAPv2. | EAP-GTC, EAP MS-CHAP v2 | | Temporary Access Code | Grid or token authentication must be configured. | PAP, MS-CHAP v2 | | OTP (One Time Password) by SMS or Token | Two-step authentication only. | EAP-GTC | | Knowledge-based authentication | The RADIUS proxy only supports a single question and answer. For CHAP and MS-CHAP, the answer must be an exact match. Two-step authentication only. | PAP, MS-CHAP v2 | | Entrust Soft Token push authentication | Mobile Soft Token push authentication (supports response-only tokens for second-factor authentication). Classic token authentication can be used for fallback. | PAP, MS-CHAP v2 | ## Prerequisites Complete the following steps before integrating your authentication system with Identity as a Service: 1. Install and configure your first-factor authentication resource using the documentation provided by the vendor. The first-factor authentication resource can be a RADIUS server or an external authentication resource (a Local DB, LDAP-compliant directory or Windows domain controller through Kerberos). 2. Install and configure the RADIUS appliance using the documentation provided by the vendor. The device must be able to route traffic before integrating with Identity as a Service. 3. Install and configure Identity as a Service and an Identity as a Service Gateway (containing a RADIUS proxy agent). Take note of the shared secrets, IP addresses, and ports you use. You need this information to configure the RADIUS appliance and first-factor authentication resource. 4. If you want to configure your RADIUS appliance and first-factor authentication resource to recognize Identity as a Service user groups, you must define the Identity as a Service user groups first. ## Integrate Check Point Security Gateway Complete the following steps to integrate Check Point Security Gateway with IDaaS. ### Step 1: Configure the Check Point Security Gateway This section describes how to configure and integrate the Check Point Security Gateway with Identity as a Service. Check Point Security Gateway is used for Mobile Access (SSL VPN through a Web browser) and the IPSec VPN (Endpoint Security Client). #### Step 1.1: Set the static IP address to access the Check Point Security Gateway Check Point Security Gateway systems ship with a default network configured IP address of 192.168.1.1 on the management interface. You can access the web-based configuration utility through the management port, and configure the unit directly. If the default IP address is unsuitable for your network, define an IP on an administrative workstation in the same IP network as the Checkpoint system. Once the utility finishes and the system reboots, these default IP addresses are replaced with the information that you entered in the First Time Configuration Wizard. Use the following procedure to set the IP address for the computer or workstation to connect to the Check Point Security Gateway controller. To set the static IP address to access the Check Point Security Gateway management port IP address 1. To change the computer's IP address in Windows, type network and sharing in the **Search** box in the **Start** **Menu** and select **Network and Sharing Center**. - If you are using Windows 8.x it will be on the Start Screen. - If you are using Windows 7 or 10 it will be on the Start Menu. 2. In the **Network** and **Sharing Center**, click **Change adapter settings**. ![Change Adapter Settings](/assets/images/change-adapter-settings-89eaf069ec5d92dbad9873dfa877a3c9.png) 3. Right-click your **Local Area Connection** and select **Properties** to display the **Local Area Connection Properties** page. ![Local Area Connection Properties](/assets/images/local-area-connection-properties-f95a0f942f01a49eb5d374fd28f74482.png) 4. In the **Local Area Connection Properties** page, select **Internet Protocol Version 4 (TCP/IPv4)** and then click **Properties**. ![Internet Protocol Version 4 (TCP/IPv4) Properties](/assets/images/internet-protocol-version-4-properties-06ddda9bd053ecb3d2e573c918115385.png) The **Internet Protocol Version 4 (TCP/IPv4) Properties** page appears. ![Internet Protocol Version 4 (TCP/IPv4) Properties Page](/assets/images/internet-protocol-version-4-properties-page-47ff38a9f77ce1f73c8ec332d358a6a6.png) 5. In the **Internet Protocol Version 4 (TCP/IPv4) Properties** page, do the following: 1. Select the **Use the following IP address** radio button. 2. Enter the correct IP address. 3. Enter the Subnet mask. 4. Enter the Identity as a Service gateway that corresponds with Check Point Security Gateway Management port network and subnet. 6. Click **OK** to close the Local Area Connections Properties page. 7. Open a command prompt and type ipconfig to see whether the network adapter settings have been successfully changed. ![IPConfig](/assets/images/ipconfig-df82fc3adae5ddde507528b51f158673.png) note Before you configure Check Point Security Gateway and manage the system, you need to connect the unit to a management workstation or network. #### Step 1.2: Run the Check Point First Time Configuration Wizard After you connect the management workstation to the management interface, open the configuration utility and begin configuring the system. When you start the utility from a Web browser, use the selected default IP address as the application URL. To start the configuration utility in a web browser 1. From a workstation attached to the network on which you have configured the Management Interface, type the following URL syntax where `https://management_IP_address` is the address you configured for device management. For example: `https://192.168.1.1` (which is the default). The Check Point Security Gateway Configuration Utility opens. 2. At the login prompt, enter the default user name **admin** and password **admin**. ![Login Prompt](/assets/images/login-prompt-6411cfe4b53e2b363da3934d9f3e7e08.png) The **First Time Configuration Wizard** page appears. ![First Time Configuration Wizard](/assets/images/first-time-configuration-wizard-3e259c0afb8d0b6229917d0db3735a52.png) 3. Click **Next**. The **Deployment Options** page appears. ![Deployment Options](/assets/images/deployment-options-a1934211de89824507e3f63cd5f698d5.png) 4. Select the option **Continue with Gaia R77.30 configuration** and then click **Next**. The **Management Connection** page appears. ![Management Connection](/assets/images/management-connection-1350331da0fdf988b75a1bc6eab3e2bc.png) 5. **Optional**: Change the Management IP Address, enter the Management IP address, Subnetmask, and Default Gateway. 6. Click **Next**. The **Device Information** page appears. ![Device Information](/assets/images/device-information-a999ae585722d6a4408c260cffe11987.png) 7. Enter the **Host Name**, **Domain Name**, and **Primary DNS Server** and then click **Next**. The **Date and Time Settings** page appears. ![Date and Time Settings](/assets/images/date-and-time-settings-404e396bdc4323e7a196122fa8013b7f.png) 8. Set the **Date**, **Time**, and **Time Zone** and then click **Next**. The **Installation Type** page appears. ![Installation Type](/assets/images/installation-type-489f95314856e62505ecc9645cd44648.png) 9. Select **Security Gateway** or **Security Management** and then click **Next**. The **Products** page appears. ![Products](/assets/images/products-a86d90778a9863ed237de4b5e98878b6.png) 10. Review the options and then click **Next**. You are prompted to enter a username and password. ![Enter Username and Password](/assets/images/enter-username-and-password-36f6a01c7b54cd0d61c083cafdebb1bd.png) 11. Enter the User Name and Password for the Security Management Administrator and then click **Next**. The **Security Management GUI Clients** page appears. ![Security Management GUI Clients](/assets/images/security-management-gui-clients-455b4c2b0b8e47d15ee395849e336704.png) 12. Select **Any IP Address**, if you want to access the Management IP address from any host and then click **Next**. The **First Time Configuration Wizard Summary** page appears. ![First Time Configuration Wizard Summary](/assets/images/first-time-configuration-wizard-summary-d9764618f7e449482abae37ce7a22a01.png) 13. Click **Finish**. The configuration process confirmation page appears. ![Configuration Process Confirmation](/assets/images/configuration-process-confirmation-2c1ee1f26e2289c90ffb23585a688793.png) 14. Click **Yes**. The Configuration Process progress page appears. It takes few minutes to complete First Time Configuration Wizard and then Check Point reboots automatically. ![Configuration Process Progress](/assets/images/configuration-process-progress-479f4c23b0bb589595e4407aa000a69f.png) #### Step 1.3: Assign the IP addresses to internal and external interfaces 1. After Check Point reboots, access the Check Point Management IP again at `https://192.168.1.1` (or the IP addressed you assigned to it) and enter the new credentials of the administrative user if you changed them when you used the First Time Configurations Wizard. The Check Point Management GUI appears. 2. Click **Network Interfaces**, select **eth1** and then click **Edit**. The **Edit eth1** page appears. ![Edit eth1](/assets/images/edit-eth1-12c527f4db8e4f4101ef3d56888dad4e.png) 3. In the **Edit eth1** page, do the following to set up the internal corporate network communication (for example, RADIUS authentication and application access): 1. Comments **Internal, IP address** and **Subnet Mask** for Internal / Corporate network communication i.e. RADIUS authentication and applications / resource access. 2. Check the **Enable** box to enable the eth1 interface. 3. Do one of the following: - Select **Obtain IPv4 address automatically** to obtain the IP address from a corporate DHCP server. - Select **Use the following IPv4 address** to enter a static IP address and subnetmask. 4. Click **OK** to return to the Network Interfaces page. 5. Click **Refresh** to see the obtained IP. 6. In the **Network Interfaces** page, select **eth2** and then click **Edit**. The **Edit eth2** page appears. ![Edit eth2](/assets/images/edit-eth2-0ddbbcbbc66c1a6c6f1bc1ffd89eaa3f.png) 7. In the **Edit eth2** page, do the following to set up remote users VPN access through the Internet: - Check **Enable** to enable the eth2 interface and select **Obtain IPv4 address automatically** to obtain the IP address from the ISP. - Select **Use the following IPv4 address** to enter a static IP address and subnetmask (Public IP). 8. Click **OK** to return to the **Interfaces** page. 9. Click **Refresh** to see the obtained IP. ![Refresh IP](/assets/images/refresh-ip-2f477a3735f4576a9e4916f2bd09350a.png) #### Step 1.4: Download the SmartConsole To configure the RADIUS application integrated with your Identity as a Service account, you need to download the Smart Console. To download the SmartConsole 1. Login to Check Point Management GUI. 2. In the menu, expand **Maintenance** and select **Download SmartConsole**. The **Download SmartConsole** page appears. ![Download SmartConsole](/assets/images/download-smartconsole-3670c171cbed403e6ca0191322b764fb.png) 3. Click **Download**. 4. Save the **Setup** file and install it on the client computer. ### Step 2: Configure Check Point Security Gateway to use Identity as a Service When using an Identity as a Service RADIUS application to authenticate Check Point users, you must configure the VPN to recognize the Check Point as a client. You must also specify a shared secret for the RADIUS application used to authenticate the client request. The Identity as a Service RADIUS application must be configured with the Check Point Security Gateway. This section describes how to add an Identity as a Service RADIUS application within your Check Point Security Gateway settings. #### Step 2.1: Configure a connection between an Identity as a Service RADIUS application on Check Point Security Gateway 1. Start the **Check Point SmartDashboard R80.10** on a workstation or client computer that is already installed. 2. In the **Login** window, enter the information shown in the following table and then click **Login**. | | | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------- | | **Username** | admin | | **Password** | admin or the password when you configured the Check Point Gateway as part of the **First Time Configuration Wizard**. | | **Server name or IP Address** | Check Point Security Gateway Management IP 192.168.1.1 or the IP address that you set. | #### Step 2.2: Add the Identity as a Service RADIUS server host 1. On the **Check Point SmartConsole** main page, right-click **Network Objects.** 2. Click **Host.** ![New Host](/assets/images/new-host-62c70161142a326a0c3cf70cb0861f39.png) The **New Host** page appears. 3. Type an **Identity Enterprise** Server name of your choice and the IPv4 address of the server. 4. Click **OK**. ![New Host Name and IP](/assets/images/new-host-name-and-ip-f52cb3116a96054e867bbed2e3e8b361.png) The Identity as a Service RADIUS host has been created. You can find it at **Network Objects > Hosts**. ![Identity Enterprise RADIUS Host](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAP0AAADHCAIAAABdtsJgAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAA/aADAAQAAAABAAAAxwAAAADUV+1PAAAheklEQVR4Ae19K3jyStt13v96ReqCIzLbpQ5ckdkuOHBFZjtwxW1kHgeOuC8SXHDE7Uhw4Bq3I4MD17j3X5OBEMLhgZZSmt65uNrJnGdlzT33nP+jPb8I9BACd4ZAKVrJcrEUBZ+Ur/9+UrwULSHAEZCEyBn0j6HxZ6N9zOlM+5XwAJ+S8Jbxf8yee/t/Gd/0Sgh8OwRqxrMgMvZvH/EBlnKxuLXZNZG838WD3j4HgX25frodOD8XFcMQnp405dGy+2rA9CJfkptGU1AVpfj4+uuwGk/y/nyE79rnchUUZfmus/g5mXO8sbBYCMVi02gxqS8+cNILq8gZHtWvvkbeK1EEEMR3AREJLGwoSvjLTPS8F8nPRu6fQTdJIm2GZb3RSpw+aICM98yO1jFB/bLZjZaRoBRB+rnZUVfhsci/gPdSoaCpalFRCu9kvrCMwtFsHgRHS3WstGSfTwSiNyg5kPcSFHrIw1VkWeYJ0gOEW/NeiVbPmq6xXgiE9VZec9O5LQCCl0sjP/DFbIiSIjfqNUlRAt/3JpP5bC4WxEatYdmDMz+5KETN1kuvb2X8m62GGDcyyyjyZnN/PlvtDiGgPhuNZ6vfi/bqM5yi5VIsFITobfW2LXUmify9Qq6v9tBgsj9aXrmwEPPLN6EYxxqtfhv5F+j3snJADY1WS/yEvdEoFGC1WuKXKUlBPBAJFNxO58XxvE677XmuYRiyLBVEUZaVTPDTr6p6wL+iqo47sgY2qlMVVVfTMpGA2ZPZNGPJX7vm36jksiRqevWgh59m6TgD/K5W6o1Ov4qfra5/PIFby3tREKNd9WQhSEEQdCfzev05DPwwnPtBGG7mKyAiJakQBWGjYTwrpyQl5LRR190JBLEPf4vXcNW1RRFdiUAUI10rV8pP4KXnTaAP61WtoqphFNkDG6JHVeR6vfYGQe65/itLm7cjhtFwXG8RrnMMZodhFIZ+QXQqFc0du6VySatU4AHeULJHuTgXBGRjNpvrVd2H6ul5dV0viAJaIdtx/cA5/i1+kMvBduB95U9Gb6DeBKYJ8cl1ffxNRnj2Y7417/dzABuQo6Jpug4pi5/O/YRoIEUBgh7Nw6DnHQyYsSwUC95onFgGgQ+zLIslpTh5kGzb+ttE/QogzjHGZdlWqaLVa8bAtptGwx6NozBoNludX+veWLPVRAwrVgXX2pSsKJEoSAVBq2gT3wezy6WyY/fLlUrn75Zl9Z80beCMdF2TRMF1Bqir4XLleFNNq6BGJRkjwxURqNfrkFtpnZ7r+pD69efWsXHMr+f9LBQmgdCQRXBlESygjksSG6uRYl0NerSklAriw5KpOrtzE7vggZtSobirEPH2QQxWwmjMag6UflUWq2U1CAO1VIay/VRWZ54MfRA9AejlHWsAZuMx281guYpDrUkPS2gpUSQiJ85kOp/MTLPtDAfzMJo7nqPrRbRNcRVBQUaeh5bBm/hQseaTyZsgLqGAbuoPS+BunjPH0d8poaOlJDJYPu95dZyiJM7tQdKRXY/wGM3QPSprvp734YL1QhSZocPIjTcF3Z4IncbV6i0Mw9JKxRs4epr3CL4Am8uPXMzjFfJYLsqu66zi6QzY8HpQLMqzzVjQyBmKBSkeVoW7EIHXsSdoRNB8HFdOlBy4Dqy+j2aIPevKAM0nfmUBuYH/XTJvIgojC5/71dOJ3qH5mkr8keJBpR/1rOw6hehtZLGRCelIqK/nPfiCn1hk/dRIKihyMQoXr/PXx9JjQYFirEDuRsUHfw5940BfNikX1KKBO+0YtbnnQLgqsqTrervTRr828cMN0/krDBNvAj9a3bD6VstoyAUmkjsvhtVjeo7rzaJIajdqZrfHRyQgs8Hl9FgNBlLLFS1wRuqjAtcg2/deJ4sW7AHh0I041Bdfe/q6fyjd/mTqoexkYTzkZ8fuZLQXx7YTdeoly/iN0zF77v71vOf5AMNX4NRqCXYH3kQtq+EiVAqKWlLn07mwEMJgIQiPm0Id/u/PZo4kmKYJFsKHPRiyWYwCxvvXwngF5eMN3QlXrzU6ZieK3gaDEXw6zqjb7QbhYjKdgf2rJdISvAl6HapaqUwnM7wyy008eMUzGA06RrNrsUlBq9uDyOcBoVZtH+QA0w3LVbvd7vSvN4KxTYBM70HgPzdeh6xGkWE0S0ybWT9uKNmWZU/6gR+USmwA0Z/7BakAnQekxysaMtvxB/Z41tkOAs4F1k/dH7/fxPqz/qOWhyv019nIUj5Knv91yHxRyTJcSNK628rpXlxPQmAcU5ILqADbgZp8fNr9UogPTClbbfoM+x7I5loIfL2eA529rIiL1RuGF6HqZB70D+de4Djumd1DSD5FYa1EsFhEb0c07kwal7xiaqzAZsEw5hlcnaDNpoE4bdu+JEf59DsXpfkyck/26D5S8q/nPXJfKlf61rAgiZLM+t9sLDJaRYxarGiSpMiyXCmX2cvJB8PnGDf0MfQpSQ2t4oxGH6EmhoMw/ZRoDlhrUK/VijKrVPwZDWwsldi80f/vhMDX8x7jx1oJMprxaR4KGLiEQr9cPqwiCQPhoviA3mcYYqJ0GQYP5VLpWdn2DTJIo270uutZp8MLBjIBTr4i6bR7vfGMAVDPHfo+JoBFRZGTAVM0MnsNFdbDFvYbHL5QZ99zOqG0OYnkqVJGY4iOe9qVzO9G4Ot5H61CjKbPA0yMhvOlUCzIIDzmlVCkQkEG2VnZCrKwDKMgYvrvoeU96/KDj7sU5EP4cMUaBNAU1esBXh5EdCdGjgNWNZ5rLOyDOB57i8AHvR7VEizYLFO0qmh63PK8Ba9BUVIwEMTHduCBtwPgMUZLY81KXIQ+b2FqDQPzwXyMf2tZr6ssZpbBXq+HXLCAqO3RNiDLSfzAU63RUBSWk8UqcAbDtQP9uxICX8N7Pgo+CkSslvHimSBJWAoFBeocpm19NhBYkISwqIhvkf8gYfap7EPii2LAZ1OPFN4dOI1WczKZBrMZl6kImWg7Rqs5dkacr6AmNHWYuTLNKoDxbPfZ9OrYddd+6vWJtzZDg0KamO7NpKzpNUVBfWCTwViphoUJVr8rFwposjBlU5DlWq2GyjObeKr65E1c3/cxMY12QK8Z64Bx7eIBk8i1eh11aeQOscZQb9SRCnSqxJUMH0fga3iPfE/mE9thsrykViDrZSjxBUyjBpguxRJKrM6E0yJcyIpaEKPZpn3HwjBUiWPFhrYdDhaYS9JaGipURiuAjE8CYuEbSAl+Q7Ky5cGsodjRahKf3AAqw7Da7XejtmClD1ZSTCeM9wWxUKo8SfH4FJiNyNmv8oTeySxewBz3PaAl+UgUAWHAKjkWvyhpFT29W6qklrCmDTUdjpgdi1sP5pGeayHwNbzHHOEc1IvnL6VVWFYUrKaczLxCxAb2McLDJ2bFcCkEbKU2Fi6gwJjbqpSPkp4jgp6BN3aw5BKCf4kF2aceUcWCskrp9dV/eCjwRUHHvCOzENjY1rBIzcqy/gc0os2QOWov9BK+Rn8bD1bbPzxAg4KwR2JN4wV052vUECf3tsKiico2BKoTogHXlUaD22JCbOtMpmsg8DW8R85LbDQw/pyxCq9IhUq5AtEIMslMS18/6S2jfOXMOtTGw8H/qCWvM2jzp9Y1ICCWENv9LteI9mUq+tOQxJgRgk++twvEHaUGcLj4RypT1DMmwlly0WrBXvYeiHb8oC9BtPuyj0XLEP/cF5q6tPe4NxxhrRENaKZhua75a3iP/Y+iIncrWI8jlhUVK+xTpQIPORVTdty4rQ57TrEFV9m5W7lc9sZjDOYf9spssergDUpOsrYs43O5XIDTENWwh8YCOQ3lBJ0EtA+wAWuh/fv+FL1Vvd5ARxgG+Dk4coqMoQu7UZMi1PT5fF4qrQOWKiwgkkDYIjxCd5pPSqUKOiHoD0AQBIvV4pVGcjLf50OvX8N7ZBlcr2iMlFJqzcJHioKhlaquY2QGYzfoHWBXFMikBNslPWFqHhT9TnQZ0c3F6KQoPKAC4IfU036w0lhvGM1WGwIYnWP0LJ8q2mNZxeJ7+FysQqyYdh0n0gS1rAiqOMfOxngPESKJ4s46izBYQZuDz/JjWZKKq9UCHQ9QHAHRk98GjFfMoktdr2MY59EdO8u3CEFUvYYgq9XkcCPyEbx+dthbr8/BaH29rj9/eE02djdBDVikNKKf/B3REOZsfc5nf80v2F+LUb/9/bIXlRPBhy6tbbwIM/K8g8Ct9RyM5GAZQj3e/bSTkXe8kLDfgHakP7Rxpv97CHyBvN/LA1lcAYGCpKDbcIWIfkYUxPuf8Z2plLsIEO938aC3n4EA8f5nfGcq5S4CxPtdPOjtZyBAvP8Z35lKuYsA8X4XD3r7GQgQ73/Gd6ZS7iJAvN/Fg95+BgL/xcL39BlgfMkjLH9G8amU3xiBDUe3y3Q3Nr8v1H+cf2a2PUgCII6GYegVNd5T8fvw5IMQ+CoEsFsIJ1S/pfbfPWCN63nPf2taSS5I3c0pkA0sltS2R2WcFwn5IgS+DIHzuZ7OItPv09d7aKXtgvW0PzITAnlCgPE+rdIUcRccPYRA3hGg8Zy8f2Eq3yEEiPeHUCG7vCNAvM/7F/7x5fs3tSU/MRPvfzwvfgAACd1RVm4m3v+Az05F3NCdIwHqE++JFD8CgT8et+fIw0y8/xFf/YcXMkN6oEG8/+GUyH/x90mPMl98jgguXQto337+2XIXJcTxivyqv6vn5jLeg/SiVNDjawavnhWKkBDIIIATEqfT+dMTzpm+8nOZngNJr9BChit/AoruKAJFSVqmTjU96u9yh8t4f078uBth93qEcwKRH0Lgpghcpuecztpw5L0GAQ5ux2HWj4ryXNNO+ydXQuCDCKyvvLw8luvw3vMFy7Zxzz0yUBCiIPTd2WowWZhNXFVICzwv/ywU4jwEcKXTuTtNdiO8Au9xlnzPdnCVk66VGlUdV9Di8PeBN3fHntXrmt1ucbsRbDdxeiMEvgiBj+r3UOUH7gSkr1c109DVIlvNj7/mc6ldlWdLuT+an1c0tBWsucBDPQSOA/39PAQ+ynvkzI/vvalpT5lc6rVn2EzH5x5Ub/3qY4oBP61Sj68zzMR38Ssaor/qDXa1CT2EwC4Caz0Hx9Lv2p/7BunusXsJQ8j4zAMnXNMWsKsyf/8E9ov91vr31YRXb2jjtp6PP9LSfRO1KL5D8+OxUQx5QuAK8l5VCqGgHBy7DMJIFta3VZ5GDden1TcthvZsXKdLELz6yuN1ojqde3L9bghcg/foyQqC62X1+GFsw2/6/i0sRUUd4L6q5DwTFmDaKTO1B79f8fXG6ADYjbVNudyZxpHCU2fKfMYW6yDlcn0Y4PLNALdzwgoxPDYykf82R+QhzwhcgfethgaEzMFkiOHMzeNOfdOOr3Xd2Jz+rxgDW7H0yprNMenH1dkMS6X/7euOB5KD9Lqnuczm1dLBaFZJFq+B4DaZz5kpdMrNhy4LMps5z8rC8/xpD0GY/xru/76G7nS6FOR6hwjgAmz+pPN2hXHMoiTabd3ouqbt4Vd6LATh22rTMx15QeHBe3lmdeP082TOZhoEd8eamU/eeBi5w0cXQaQasxC8jqVYMyPuRnhjV6majMfB3FfaDpzRLRi7ujXbpsOczDEqwOlkyTWfCOBK5KdKxXjGvahFzKbi7yJYDIbOYMKUhyvwHrE8lZSxWe+NJt4snL+ymYRaBRp/hFeY7TFrB86hvqC1mupLEAjI6dOLO+AsR2B2YzhTWmKjMPVcVWlx26Wqa/F132kPGScWOOk98Cjob94RAOnNv186v3rTyVrv0Cvay9/NZU90PfcKeg4HEPWp/1J7HTT5z2zqeNXK6xvoQf3ecK2k7wM+7WzUmwC6CRol5mXujXfVfQGqCnPwOk1Iey0W/Ls917UH5gkVZdupDbyxUMR5WKx7EHcV9g08DP3NDwIg/Z/VujuZQAzzHyR9vdU2Xww0BVfj/UHAMtS33Wzfl4cqKkEj7r+W6041VloUo/ciWJW4X8t7sIrR0t0meqhl77GprlV1CP5EjiNIM4g9xJ3atBMGix5pucTBL/TDLNHw8xL/53//+x9Mfzba/P2fQfcEFK7r6fpWgz7hM+3U6o24wgPLidWQJDb+Qw8hcA4CJyiHc2FPrM+ZjZ0/q9Xl3sRUbF//XHnPC5ZI/X5LI9Kf87HJz8cR6P2y/hmP10pzHB3MTt/CqmG8Xadf+9tcgvrzYEFrM38LFHm4FgLQ5uURiN7FYM5DHCnOfgXpu7aFtxvxHikR6a/1RSmeMxHo2uyBmFdlxcdS/Y1yj+C34/2ZeSVvhMBVEMCgDX8Y31OM55aX8R7727G8kXT0DaT0/3MRANkKhYTAl6X1z9g5FqBcrV/Ge0VV/Pn8k7b6Hssl2f9kBCqV7TlnF+HgTf1FGDoem/LvvrTt4cBPnX9zGe+xtPgzDnW4qDzkmRA4BwHtSf2z2mFrBwThr1YT4h9iPgl4i3HMJDEyEAK3RAA9WihJ+KVHM3kGLpP3t8w0pUUIvAMBUJz3YjF+/3/xIGawWEL2D0dM4Uke4n0CBRm+PQIQ7Riw5/oMxu8HVU/XdJTKGtiZIR3Sc779x6YCZBDgXOeWWHqJX5r0XOcheZ8BjV6/MQLoxWLFJUZvsOhyvxi8HeANQt54PxwOn5/ZOQ6f8Xxq5J+R4R8YJ0Q7Rm9Q8P2+LEcDFQOGvPH+B35pKnIGAT52uYznaMvxZo5Zar6W6zzE+wxo9JoTBCDvodIkhYGYT2v51K9NkCFDrhAA6TF2iS1XKNVfrXa6DsDmZ/HenQb1zpAfcJKrj0yFOYSAHS85hkta0nOPd6rnPDbYImls1U0Mh8p1sZ3lTINwiQNOnrUSAvPIM7Eg0YzNFV+R4qfGf8Ws5iKq9X5U7DHPFOdOec9zCZZ0W/rqbXUtujR0FaQ3tPVSJ6Jghg15esW6NF4cGB7VEld4kgLetZ6DfYntPo7lmXSMykHZnBTjTAPEPLj+YmSPsD0z+Pu8Hcv5MXuWyiqCStr4NZzzM21XUb1tp07lel9GflaotskWpaF3OxzY2GPFB3kSCK7J++vqzQOz3uqvjx4B9bst7RRRkgLdnwE1jeecHyHKz2eGzenWRhJF4e3Nz3yu+yvdPecIu2mxRAc/GDL5vBrvQXqwMxP7+17BCc+sNzo7+wbafQ+nsn2Q+l/VrwXFQfpmbwRAGqYL6p8mPcetqlUm7MzQ1UJMnRu6ihrtHs6/wCkViLNjuz2bHaKIJqLaHo5Y277w/XmrN/QXZ8GPSJLfWQG+iSecmzCdzzBHix8M7i71r6PfX5n0VqPRNNFGZRDGUYRoBH4rKTOh0q9f1a/lpJ+/stPj0LEG9Qcd/bfb1oqKIinBzPfLqpqUAgfdVes1vaR0rNEMx01j56g/B1Z+6OPIjNl8XlPl+WQiK2dt18DilZG3blS1ipazK8ni8RzWtYXheTxOMIThCrxPk/6EPD5HwiFD8Aa5hYPF07lMzO1O9/XkCT+Jz4OGG/drj6EB6lea2+swjiFTEFatht63bFXZdEhWkTf3X72gH98jtqiU6mqh486C1bM7fzU0deJ5i+jldSXWNSU+pvogDFtLnIbkTgI/8Euy+I6TkbYR3aUpOTwnMSTZvALvw8WVlVDQIslfxnCsPmS8HXtFv5aPYB7zcF37hNA4kbTR6aYzj4brnAMmIKxwM6TrDJOMQe9vmWbpQSjEp28VowiHBQS+vwyDmq6hccCxGdFyJcvxOYpJsOMGo210zV6z2Tju5Vu6dHp2Ot+Z1yvwnh/4yg9/Tb50OsmPmHmExwTnR2K+ZVic3DIw2wn1zyR9FL1Br3/WKm3TjMRHNrQjrbCD6HU6L8XzD6wI0qpSkl/GQfmxqkiLqiLaXig91thtF+gJdKxO+0UVI8TQNtl6rJeOzWxSlaIkCYPuC4sqXw8OisRy/M0TYYUmbPDKZep1+rWgvlHd6qCbxO7u/1f1a1FvOfWBCCf9BTVZEg2jvrmotVh/buHKMOOl02y1WbUQhKIir4JALjIuwzyZTArFw1oi8/1jnr87JvbUbn5MuedmDsAV5D2P6Kxjvr8a9C/p14LivNUC9QEAV29gk9gfQEUSu10zsVfV0mzAJpjxIJLdM0xxU0zxdcA7AGkzmgJxI8i3sW1seGR5/ou9hZgD4dIdgh+jmXwFMi/z1XiP6O6f+jfu13KIj+l+x+zzTMYblg3TtFiWw3kPFZG/Julfk/dJpB804NT85PzkjD6AO+Q+EvmN+7UfySqF/SACXnzyPSLBlK0qy7/MTjrCe+Q9DpFNZzFPZpLxN/ua6MhiZy2SwwpkCHtc+FOP92HxDFynX3uzwlBChMD5CBSEqG00cQYyhD3u40kHvEd5n84fmQmBdyNgGE3MQGdWYvLYSN6/G1UKeNcI8NMTMF2Fri1+mXmry+75ueuCUuZ+GAKn7/k5DQbJ+9P4kGs+ESDe5/O7UqlOI0C8P40PueYTAeJ9Pr8rleo0AsT70/iQaz4RIN7n87tSqU4jQPNWp/Eh17tGAPvL3pe/y+Q9tmMmyZCZQ0E43AaHhHhpg6wo7/vRvFUaRjJ/JwQwbwXSvy/Hl8n796VBoQiBe0OAeH9vX4TycwsEiPe3QJnSuDcEiPf39kUoP7dAgHh/C5QpjXtDgHh/b1+E8vNZCJRUtabr3T47T4rmrT4LZYr3ThDAvvJara5rGrYaYrIlCNjZucT7O/k6lI0rIwDprulV0B3xup5nWf2Ry7aZ84d4v0GC/ucLAcdhJ++225003ZMikn6fQEGGXCGA7eSWPWw2W/+M3X63C80+XTxap5BGg8zfCYEz1ylA4YGKr2kaDjofeXPP89zRgOT9d/rSlNd3IDD3fag6rXb7j8fyxHX0CjtplHj/DiQpyPdAALoNJH06r7wCwIZ4n4aFzPlBAGp9rNw7XLOHip8uG43npNEgc34QwGg9FBuU59/XGcQ8u8WIXXyxfkjeb5Cg//lCAPcdZZScdPlI3qfRIHOuEMAFJ2A/igSRn94WBxvifa6+NBUmQeCv1KnfsMQdEIkTDOfoOdNOufzYwAXCPODCbpTL5fpwJ550nGQmBK6HQDCsg24d3E192QOip59M4JvIe6/zR8s1+rO/tUzq9EoInEAAArc5jKVtfGfpCZ8HnKDbHLCNrdDfvQXv+f2JxzJB9oTAEQSezNnMhLyvd9+hWxw89j5J6MO8j2U5j+7pxR0YuFUiVU1rliU0GyPmbrfKTs2amcK2ErPXzU3cSY7IQAhcAwEoOQej4YM85/I+mluVspVEJOFaYDwx6aWYvoHd+LOn/1Jmmtd0BcUcO8/rmbLZQCiD+lzPQZ3YdU2iJAMhcE0E9vUcPpyPQZ4L9Byx1PRsg92CLaBfq1ts7b7AFZi6xmS2olVLlu9402dFXUV+p1oer8U/85k8uGH1hGvijQyEwAcROKbncPtzxnMuy4BiDP7tszWf056eGgVaR3La9bKUyDchcBwBPpjD3TNmWH6I908a4/drPDUQeON5JHDZL2jmv6/WM9eF2BXb6k72dl13nOiFELgSAliWA1Xn//oWfjBk5m7P1e8PZwYM7gt/tPQ/eswd/VqMVEKD5x1ZSVQ6ZqwaGa1nq8n7tUk3d+t6OGqyJQSYRv1rHuMwav6x6SKeiUu3ayabrVAHuFqfhKV9JwkUZPhmCJzedwIZzzuyvFSZ1w/pOd8MJ8ruT0IAmwxfXtYrMGHAa7r0JO/TaJD5OyHwW3l/rDAXjGMei4LsCYH7RODYOCbP7cf6tfdZYsoVIRAvwER3FptrD07ckn5PHMknArTPMJ/flUp1GgHaZ3gaH3LNJwK0zzCf35VK9VsEPrTP0GcbFOkhBO4CARXr3M97Tu8zpPGc81AkX98NgcwwTma+lnj/3b4n5fc8BHBQFDszJ/WA+njjixeI9ylgyJgjBED69NQVdP30K/E+R5+aipJCIL7aZLvVMPNK81YpqMiYIwRwAHK6NMnrZftr01GQmRC4fwS4Np/OJ9fsL9tfm4RvGdXEfMzQt8fHnMieELgNAmltPp0ityf9Po0JmfODAB/H5FpNekyTm7+A9/NuueMKkmJ07aYMnMNhtbE+m1wS9bZjlh720J90qggjCNidWO86tcc9D2RBCOwiAMZDpUnsIObT7P8C3qttS/e68ktM+kmnYQrmeHaA60mWw6Fl+jh+h+ieQEKG3yIA0p/YX/uV4znR22I0COrdQwJ+t1ihgKu5dqwiYWrp5apWbnQ9OMSvdavbaNQ6VrNs8aMRUakMK1y7HvIcu+7ESy85QgDXPfDSJIakcF/Je3HlzQTt6bdKi/xsGAEOolqzOc67320K5swZu/XAHr3y4gSBYg5Gpq6pE49VhvnElXUdqtRRz1zRSsAgQ74QSM4OSQxJ+d6j55werjlnwCdJPjEETqNl+cfUd6U+cOpTWy83ZNYrKAjTiSe4Lo4cZI++PqBcqaisUVAqVcULQnbiuVrRFTQFJzzHEdCfHCIAhR6qDr/uAXO30HnShXwP79/H7HSq3BzJihx0p68GFPcNs3cu30oHEYUnw3Hljj6aNQ12bZFi9Lcd3DXz4wCRpJWFl/nkAY1Jc92YHPWcToLMeUIAYg8D9vxSt55lpTu1KObFvE8Le1QA/poYLgIOVNYNsdOzni7VN94UWQ0mflB73NX64+TFh6Ki+LOJImgGlJzopOeLMkyevx0C+5o9L8LFvE9KzqV+IvvPpz60bTcSpJjuEPOm0PhLs3m0atPZSOgknd2BTr07YMK+WGu37Ua9amFkkw19qrtDn6WK3jX9epfVClSD055TKZExPwgcm6/lJfz9+Tm07yQ/XPj+JUnvOzl9fk66L/vSbAbhotfbatHvl/efhCG6obbOGgT+oAXo1g8oM5+UOkWbGwTSCj0WpUH83zXvofQ33VkzN/BTQe4AAd67TWfk7uR9OnNkJgTejUBGv8+cj0m8fzewFPCuEUivx0zrPDzTXzlfe9ewUea+OQIlVQXdOeP39Rzi/Tf/vJT9Iwjg3gfugllbTdNwbGDa4+/1nPTIUTokmQmB+0eAn3yPkZyMuv973t9/2SiHhMBBBED6pvHMtxdmPJCekwGEXnOCAKd7shwtMfDikbzPyWemYuwjkJ6oyizUIXm/DxfZ5B8B4n3+vzGVcB8B4v0+JmSTfwSI9/n/xlTCfQSI9/uYkE3+ESDe5/8bUwn3EaBxzH1MyObbIBAG2xOPL8o08f4iuMjzfSFQqmjvyxDx/n24Uai7QGARvlPek35/F9+PMnFjBIj3NwackrsLBIj3d/EZKBM3RoB4f2PAKbm7QIB4fxefgTJxYwSI9zcGnJK7CwSI93fxGSgTN0aAeH9jwCm5u0CAeH8Xn4EycWMEiPc3BpySuwsEiPd38RkoEzdGgHh/Y8ApubtA4P8DELGqMsaOxrQAAAAASUVORK5CYII=) #### Step 2.3: Create a RADIUS server object To define the RADIUS host, you need to create RADIUS Server objects to define the host, service, version, and protocol to be used. Once you create the RADIUS server object, it can be used to specify a RADIUS object for authentication schemes used for user authentication. 1. On the **Check Point Smart Dashboard** window, right-click **Servers** > **More** > **RADIUS**. ![New RADIUS](/assets/images/new-radius-1247559f8120517f481e4767debc54fd.png) The **New RADIUS** page appears. ![New RADIUS Page](/assets/images/new-radius-page-f6e89856c71c42ceac789323022049dd.png) 2. Type a RADIUS object name of your choice. 3. In the **New** **RADIUS** page, do the following: 1. In the **Name** field, enter the name of the RADIUS server object, for example, Identity as a Service. 2. From the **Host** drop-down list, select the RADIUS server host you configured in the section Adding the Identity as a Service RADIUS server host. 3. From the **Service** drop-down list, select the **NEW-RADIUS** associated with port **1812**. 4. In the **Shared Secret** field, enter the shared secret value of your Identity as a Service gateway. 5. From the **Version** drop-down list, select **RADIUS ver 1.0** (or the version of your choice). 6. From the **Protocol** drop-down list, select **PAP/MS-CHAP v2**. 4. Click **OK**. The RADIUS object is created and appears in the **RADIUS** list. ![RADIUS List](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAADWCAIAAACxAMu3AAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABAKADAAQAAAABAAAA1gAAAACqA0MVAAAlV0lEQVR4Ae1dK3jqStfO+Z9PpC44InNccOBA5rjUgSuS7cAVd5BsBw7ciaQOHHEnEhw44r7I4Ihr3Pe/kwkhDYFya7l0ZfN0TyZzfbPWrMtMZv7QXl4FugiBL0NAErzh4J9dxf9VbaY+yvuuLCt530l9Go/0hKdy7cUavAn++yZefNKqL9Oh+e65m8i00H/SIimOELgwAtuEvp8xDq++VKsJxaKm5Pq9nrpkDGNLcl2rIDKfVSa/W/uL+r/9j+npvSDgzCeKotxLay/YzuF4LCyXQjZbbzQE8Qk/Rv160fe8wejt04quIwEU30PLRPw7/vIFH5lcUcJfFqKLIXmL17+DTtSseBiRleqv6NGZAYz6VrultdrggUK77a/eBQX05c3bbeUz/QdVX4EBpExGUwuKokriKS/O8/13b/W2sF3ncwXxTHAp+30g4L9D/4EEkLJZQRLY2G/0D6H+KzAAePNF0zWIKgzf/mYE56FDGUJ6EgrqyLbtLRbKK5lqtSbJWce2rYk1ncyzcrZSrvSNwaHv0vfqzb/7vX4i/d+NWkbKIHLlraazOf55MaML8WDsavWl3/ktBNIpnj2bEb2VL2VEfyV4P0luYaT3QJIfr4Q0+Pjw1DvQ0swR9Czyi77P5MBh1xVsAFmRt9vmg0C8lSCktNvzVvglsshSSiFQglutv4fmsNlsmmOrVqsrSvZJFOBPSGTff5tXU9LnFHmAgcXoga808LCmJQrxVyt7Nk1E8ts2RLPvPUmyVnlOTfDTIuEX2uMaOhqNtd7veRj9vY09cEBB360CMb3/IzEvBclxnM5kUnmuuY7tuhjY3ZXn+O+MCjMZX5JEz1/WtdeywiyHnRdky7NmTuz5zIE8mTtOv9OXRNnzXVH0tVKhWMhj5LYsSxQl/Vkr5QuO9z4cGGA9Vcnoz2WUDOK2Z3MEuCyq1aqmOXTcUFJ5/rvr+q7rZIRBvqRB1hZLea2kee/uwLDEjKDKkiUI9Yo2mc1RIPplWlZV18CstWrZGFqI2dn+n/QgVTKcBkDo8wmsXrvdfvc9bg/gb+QX2lPydzNAalNAlCVNK+uKIAVDL7QEUXA9AQoOhn4V5GZYIQ2m5l9HQraYA3N9J9gBtcmymFeyE1EwBgOMxAt7kVNzqqJ0+j2tVHouVweGUWvUB4OB50L5qbfskEbrzaZjzxxnGak0qixL4AzYMLo2mVjlSrmQLxlGRy+VWu1mv9/Ja7owGOllXZDEt+GgXmssV97QmpRKpbEF1qDr8ghUKszjGdf7uT0AOVCr1T51g16fASaOgF9NZmS2XHogegljPlRqps4JU3sqKsUn4WnFLHpYDjsv5MHQLqw28gVaR5A663jCyJohDMMAuhNEgec6YANQ54uuzqwMplBgLaAFrc6AmxXtZm3luqOxFVE/suvliueLrrfCuD6ZzDrtpmEMIB/6Q2uo6xIzbED5THqYpgVZYVmzrKyAvd9FyV+hMUltOGjelf8c6I8/ecxG+V/aQ2c4zK6EuTWMrN7QL6TXEPlp1ddnABdKG0gjUNNBc6zFCjOPQchM23BXeU9Y+e9w/exnAOQDfauFAh/4cYsRWs7K0GE8d8mKFfAqQJwCBEWkirwN3sSMtLHGfTiZWEroMJVnXbKA6kZp6fZ7TCBAQeJm7hN0s3CiESMQy7a+VqxGyWfvntnNP/a6pKK/A0TQz2hkSAnr0X9HJHJIO3JF0ddnADQFJCdnA0KRMrKcBfU480WuVBAVGQTrrBx4WOD1RKqo3dsBeBvMybxZ1aFrYLjNyFld11utFozgxGVPJqhxNrFgHOvVWr/TaVSFrMwG6Xar1W4z77VpzXxfatUq7XaL+zEwirNygr8Bjwj2woHyMxiOFCWPp7AQEhXxW7ihnkJZlPr8ypHo3fY0bVqbPqWlZKa9xR5dWrL09X2S9D+LXz8P/78JBkBbZAzDHmMF113OTStfyjuOrap5/JtOpz7MTDb05hKtT9zOZ7OhJHRbLU6sGN2X7hL0B8dlmNK1IQaglMMxCkpfLVdvQyYlh2MTbICqJ9bEXy29FepiBnG+oBRKmjVh6hMi3znhh2UJw9GgWW92+joiYHDjKc8IjYtfK5+pPmjD6t2vN15/99iYRNdNIfDHNy+GU32/Xq+rsRHRcqV+vz+werZj5/Mq0LHnNgQB1CFQP27h2xoMXcMwZq2ND9EWWa7teYCbAvfbGgMhZ88nWrkaqXbfVvUXVXT4YrgzG3B9CZDJMOXHXS2lYJoJYU732WwoJWES8zRndvX2s4tPmcDxtZZXt9/i+2/h9RlAFlcFRVz6Yl6F1Zi8HFuYz2Hom5mNoZpME7/HWKjkIDeeHNfBzFT80UXCMNZlzrEuvEGhBXyRklFIvV7zVivIuksVeL/lzEV5vvLNvVbfRXp3fQZAN+C66bQ7Mi4lWGvgruBdWfkZz2EUJsEWluVSgalD+y/MzoJAHXsOL021WB6ORqCn/Vn2PNWfdXsBl1LoBcJKh0q5DLdmlGU0GtkLZh7Qdb8IXJ8BsHhJh62bL2IFx9zF/Jfre9L7Cgs6MCEgM9f/OxQkMMQSfqBSPr9nPjhfKHQ74QrE6eTclyIGfv2olEr1JSvBqWoylhAFBZy2pn6InW3ZBb1tWwTBy+Wv1hPLUdG7A1CK/HfGw/lCCZXAyt+dlp6cgsD1GcD3XEy3zh04/V0wQBYkkg399JmMvAqEgJCRBdCN7zMdOW0pEe+6Dwf9R1rEKI6pADx99zzbcVVFfoJJ8STC4TMaDkFe1Re2AgIxWDsEvxPorBBY3itQtO9hvUO+wJafwv0P6p9OrPksZKx5MGUBsYBVQTlVfRdEMOhwZEIvKldrBUVGDEoOIpkgKlcqcGrxdna7XTQUGZUgJsrIn7L2sEmMCn/qee4AnzvR9TUIXIcBQKnozsgRMaNqYc0Dm7BYCRkFKp8oiaBUzB8hRpIz7/7kSXqSMjkHXiFRdLBGYvdlmWa1UccaUIzNfEgG9UeKUB3rHYYmn9gCjWLlHMZyrnBjtMZCTqNnK4qMiVuu9oAE55MwzJe+zdarJKImaHoZ5fBlDkhTrZaxjBQKG5stHpuMPfRyqVSczJhLFyXD08Ucvu8rvcwaAI6CtodlIDzjpthnHdRvmiPwnqZXUMtoQIZBBM8lA9dhAPRgMp8YQ6Ze51UsSlvJElP0QWHiE8idrQ3FI2/lyFkFa2+c2YJ3esXmg4MpM37/8S80coiRAhaoafXJZJpQGDDqZ7C4KMgCNgB1Co4DfhIhXtgyip3FIgdLDJEQ897iFmyDNUW2PQcd4zaTEfP5kiQzgYOZa8ZFjlMoFUHoE6zUxVyHnAEHwa5ApSyj44AlWEZJLJZgvWym+VAOnnIDBj1CYiSj6ysQuA4DYEkCltA4InvlkrcqyApUgslkAlcPSBOxnBbYgA9bwPb4+1cyYumTqTDwjGuNXagpWN/muOlTs2scRSg8pVIeFCk8QfDsky0O1Cc1L0tZJ2ZV8wURrhva2a7r5fNChk8Yr+sQMD2WkT3XBpOohVJdzUd0Hy2ycJeMK5l2F1xQzPA/iF6RKzwmwXg8kv5eBIHrMACajqkueP9ZH1ZskUNWEkuFEpY+iFJGhfqzvuSYJSqKnKCX64c7/4f4mM3sgsr5aGcyUL/R63NlSVULiXRQPwJtnEU7gcafL5VgJ0TJ+PofuEWnQRQIFv/j24UoQTyAwR6X9qwXMboHriS+/AlpZCXLMq79vNzqhWFA/tA4gF8Uvg4DZAVPU6ROaQXVooBvI9dTYEEnQZCfk3gqHNAiPL6cThAKBdWypnt1B0b50H/glkktDSM6aJpTPEZrqDoQAkywQLd590G+sBB4ZLkC7egdTwO9JaU0JMaIDiMeGZ+QduXM5xPoOTAzkDFUeFDfagU3q5or4Ck+V4ChYtuOLEGTwuefG8ZLbS1FnobAdRgAbQXRlzSm2lxquSw8jBVdhz8H+jcsCGtiwyTAF2ERLiCvaJTFOA3Kg51aqZah/YMk8UPKeBp7NsFSOZjOKBCWNLxGxdIqV1AxhCPl0nOZ72g49J9B+jmY9WAG3OIRmCWQHqxmd+mKnoe5M2hb0LLg0sFCarAQ4yLoOVFGkxkDQ9OqVnS0GQ1DpfhsQdU1NHTlWQJLTtflEfjutUAg9yrmk/ZanIf0Euv0+0bHC6yIQ9I/dhpYDw+2Fujb3tcVvgnGYsztb3yP6jCyW+bn3zocVSYl/pkIfLcKxNbWr/wKvrQ6/6Lhf40hs2boOgmBK0iAk9pJmT5BQMnDQ0WGwicobT8mBtjGhGJ+EALEAD/oZVNXtxEgBtjGhGJ+EALEAD/oZVNXtxEgBtjGhGJ+EALEAD/oZVNXtxEgBtjGhGJ+EALEAD/oZVNXtxH4Dz78i29/ydekr78b2U5PMYTArSDgBRPg/KuMk9v0x/DfGXZ4jebSwQDVWk0v4fiWk8ukjITAdyDw9JTB4vEza/q/spZ/bdSiNcm1ivaiEfWfiSpl/zYEoqH7xBqZDVAqbtgI3wieWBJlIwTuEAHGAHFlJ9qQ8A77Qk0mBI5GgLxAR0NGGR4JAWKAR3qb1JdtBGAkRHZCPBymJAbYhoxiHgqBxXoHS/QqHuadJAZ4qJdNnUkgIAbD/38XOCTRi4ejZMQAERQUeGQEFotwc0F0Mh4mBnjkt0594whA9/8zF258Fg/jKTEAEcnjI5BbUz+6Gg/j9rt3hXh8sKmHt4QADpnI5TC3y+a6sHlZFI7aeDQD4AQ7dxXsaB6VQQFC4AsQwAaxOCCCn5v4BcWHRR7HAPO5LcqyFhwh8XVtopIJAY7AculN5/MiNt3+sus4G2C1ctX14Y1f1iQqmBAIEcDCHDe2H/1X4HKcBEjf+ftju/i0W3x90cfndEcIXAwBuPY5vZ1c4nEMsL+a0cjEaV9L183KckFRymV2hDpdhMDXIYCN488s/DIMYNl+3xg47hKtyQg+trM3Z54x8Tp1TY1tUH5mWyk7IZBAAEeWsA32z7guwADYar9rDFx3qZfy2N5ezmJTfGFgTXHuYrvba7fbylktPKNzlJUQ+AyB44zg7dKggQ1MC9RfeS6267qaZfyIv+2XYvNZsVdPhskPENrOmoiB9GACBBfKPFOx4+XQX0LgUwTOZQBUwI/OLWtaojK9/IKY6fjQjfy7rXYuvEoXmWjAGV6/Kr8goBINo1tCIEIgVIHYtv0nXfD2TFycd+dg1E9c+KxelrOOe1DJjvE68GuLRQ+FWG/G00GZEhUmb8WV+S4Wffq8PwnMPd1fghD29fcCEkCVRVdQPh6hG1aJs1DBG/vqXz9bOnZFD2WI9lLb4qZ1uqP+dxY4j/EyRR1VLyW+HwQuwQDB8aCjyTzR6zeLxeAI6ER86m1WUQeGERoBYYppq1DgOtHv8ECZpVENYwqFFrctkKg1ZSkLTSQKs/yZK72xY6odnEKHKFZINVF4aiso8schcAEGaFTYRhLtweTN2hzlOZo6bQPnVeMI6oMwVWoDQ+nra7IOSHn8PJth6faiV8bxiTCRjapuaSaLWRh6eHr6cuEIZp2lnHWeWoX6U4dlwQcQL8rSsux5V7M0xBhlnGB6UEMo0aMhwE6oDX6pHbuAGxTz1b2G1uhZbYP9mEbk47zR0PQcWI74ZL2+fC4Hiu3ZTMNQ3urP2kVrPPJHo9wIjRb13qyjCVarL3dmXDmyxqastVmHcH6u2hy2iwgiUuvMNvWwR63x4IUfM88S0/WjEPBwbK5erWLxjr308BcriwaD/tDcfBkDOC7AAChFK6pDRTaGMxOn84L8BaFcUuB9sWZs2DXGTDIcwgOC1qirrxirs46Tf7UGMVuA6zMoB9fUMlW1wUIsVmsEJB5PkHjEklU0xiR0/RgEQP2vr/Vut18zTd7pil56ff17JfQtk+km/LqACsQLAodh3ncxqPMf5gR6r7pWCIdf8ED3befJkNNmM5wscCwTdmuQaW6NP5oEAk6+ZnVZrepIfNYC4/ajmRsm4A2KPXKssZDNBUpUITAnmC3xMcDz0N/HQQDUX/rrechoHZ4k9sPYX2202q91HIge9fNiDBCVGA8keMAYpU+KZVW3Fli7fz73KsMOhmql1n0V+loQGVi3iGnoVhMRBSv3dz7kK4iCyHeELHWXJeAWcPwRXEw58gbFX8xPDTt20hL843//+x/Q+Kva5Jj8O+jsAWdkWdsTXnvS80eNrsl1IdxO+jWJHPOfQkYJ1ghYlqVtzbHyh9gcd89aoMm/g+fn55Ufn0hgA//k3zEkQ7SC6GslAG9oJAdgKxP1r98s/f+1CHS7v8fjMfw/UTWKmjcGg7dRaBLw+MsYwVEduwLgAdtZ0srQXfhQ/MURgPavKOag14YLKBOUDnclqL/XH0TDP6K/iQFQE1H/xd8xFbgfgU6/j19OhRhQ8aWKY/N5qrhS9I0MsL+t9JQQ+CIEFjYcgnHbl7uAQjY4TgIoGdnzPEn6wENf1G4qlhDASt6np6fTcICxm5oRs1QaM4LD6zgGgCjBTJf3Pltnp/8vjAANLXFAQf2qeuKWENPp1HFXY4vNebVaTXMwmG2+n9zAfBwDiBKb9IU+H28lhQmBG0SgWCy+rt2dtWo18H5Wt9vJ3KAQCtEZYdspKIYQuFMEYP4Gk75eEEjvxHESIL0MiiUEbgYBeHz4dC/mAf7p9eADdR0Xasvb21tqG4kBUmGhyDtFwIPjv/QXU3Ww8mdoVjWdrdXH/Nf2Igjew++YCb5TLKnZd4oAJ3reeMs08YtTf3xuGGlIAtzpW6ZmpyIgYb0nfD7Bks9kAi4ZjF47cIOeNA+QLPL27qHqvbyw3Si+4vrSwr+iwT+wTAz28Pmg47sM31ojXPfJwSEJ8AOJ5OG7zEZ3PvvL2WA9E8ziHdu9zlqgh0edOnhTCCiqavQ6/It0OPox8Aekn2wjGcFJROj+MRAY9Dqjt7dg6b/QaDRwm9qvn8UA2Kui0jT4fi2pcFDkIyEwGGDlM7vWKhC/+/D3Rm2AXLXP2j2oR4EPrT71xhhifYiP/VpeNLbChBeeKAyVJmIueIsav7T8Czb1AYpa70wi4AP5Xd25UQbgzQW5tBu6/+5dim6qugrqrz2Ha5mIFneRxQPEYzEc7wUC2Gch/hlkvHc3rQLhE8pWzwTJtmql1NE63pNDwhj4QfQHbdBySHGHpdnV8l3xKBX7TDYbzV8tY+6xOrDLLzS32LZjh1X8s1O9ttoAAF4gTAP3+kyhSL0uyQCX1a2H7Qo22+KNBg9AFOyhmNS+3UgkWI63nG+fynerRsx++SOKIiS44wQccCM9ubdmgPSxHAg/BHa1/WIMAOoHme6q5qh4EIfVrVZaH/ZVhyiAQDiTB65lBIPWQf3VtgEcqu0ReGA/9XO4sJGTZQ6XEACxfTQCadDFLh6N32+OL/w2zGDDpSXin5tvIyYylrY9xdPNPpV70UeG6Lc34Z09xPrnuWVi9hc/BEY7eOAyNsDFqb/6Cvm1+Z6fYw+BALHw6di550Vdywjm1M/3zMNXGuCBQav86QYZWVnB9vITa1LS2Ioufo2Gg2qlnM8r3e6b4/iSjMWP2IQ457iM4Ge2W85n5pOZpBTWOfb9j2PdzEk4bOml0oMd6xZ4gST0H4Fd6wMuwABx6t8zQh8y5qGtSIaRDPutp763Rquz2LtzUWquKPKbjeBdaIAHSnUmDfi1C5mM6L1UdMPo5wsaTwlGms0dy2Ire2Vh5WlFXc0Y5sLxXsz5oqarE8tyvPrCEypasGd3WMPO/0Dxlu3Zi1leyWi7XSU789/wA0x+RV4gBHCbel2AAdzlKrXokyNBH7vy7mKMXekT8TCCuQM0Ef9FtxFlY1tWyLR44yHKDtkmIyMJOG/THG7WssM2aDXrqiyJwSSnDE6QZfh2cUpVWdds2166nr8SDj8XoVZ/abdXtUaVF/hFUHx/se3uB8M3cRu15wIMwJ0qfAfc6JVHFZwZ4AXuGkrPLPzbsmNHmkG3FfHAgdTv+yLGLV0rtVsdX8x5vidKfkZ+sm1HlfP8EB1RWBbyct2YlAqaIi01RTQsR8rp2cB39KszeG3UFVFot1qNVlPIiq2WgZj4cT55SRh2vnDq49tATlSEVdBBDAwcIQMEsFVoGMOUoui6jBEMHoic61HRNxi4lhEMBuY8AEw49R/O0qIkVevPrss39shWqy/WeFB9/V3/1XxnL1eQFNl3bSXY/BThyWQSbi98gy/gG5vUbbdgB/MftohDzTycaMIFJAAv8Zud64luHHh7FSMYtM7lGHgA7eSaD2Ki+O3GY/OBdqcdxatqcTYId3fPZpWP+7dmVTW7CJ/GwwI45592OLS3e2FpUUxU+KMG8FH8r0bjPTj87knw4AzFpwLbnb0YA6Do2+eBbzaCOdy71MJd8dsviWJOQAATwMESIK7weGyXlA/bY4VFXpIBTmhlahacKhDtJp1QFXD8TGqWAyO/2Qg+sFWU7CsQGE/47lUe1kVjJUQwMfxB++eV3iIDYCfdr0DkFsqkUf/b3kLrtc7tYHwVMJna1Wq1Vk2x9S9jBH9br6giQuBABKAqwPnTqNcx2YevhHGCUWrGW5QAqQ2lSELgWAQw6r+Udf5NzK68JAF2IUPx940A6F4UpRabDsPYzwMpPWJHJGG2pVr95QUOo48utpQMFEUI3AgC+49IWp+El675RF0gFSiCggIPhsAnpM97SyrQg7116s5xCBADHIcXpX4wBIgBHuyFUneOQ4AY4Di8KPWDIUAM8GAvlLpzHALkBToOL0p9UwjM199zntyq4yQAZpWjmijMoSAcvgeHiPDiAUWR8fHDOT+aCIvjSeF7QgATYcGnP2ctED5OAtwTPNRWQuAABIgBDgCJkjwuAsQAj/tuqWcHIEAMcABIlORxESAGeNx3Sz07AAFigANAoiR3jwCW/Pt5VS6Xnzs9fCGA2/CiibA1EvT/gyKgqDnsmadrGrZOsizLdj7sGkwM8KCv/cd3C+O9pldA90DCtKy+YYxGbHus4NpMHRADrDGh/x8LgeGQba/fbP3Gzui+wCl+Q/dRX4kBIigo8FAI/FX5Bc2nXqvh5zgL05qCE9BDP/j0N+oqLYWIoKDAnSFwyFIIUfBUNQ8zQNeKmqbBBniDPmSGJw+hwyQB7uytU3PjCIiCv1Zv4tE8zFw9eDq37bntBAaAXy7jwMhKsGFWqA6RG3QbOIp5EARA7or64aSc0WjYbNTi3SMGiKNB4cdB4N+xCe3/3+E/YAMoQv+w/bEx6ke/sKekAj3OK6eexBGA1z+XyyFmsVjA/IUBEH8ahUkCRFBQ4KEQcJylqoYnou/pGEmAPeDQo/tGAFMBYAP0AUIA/p/UzhADpMJCkXePwK/mh/NgHBvHBYSen3jfDlGBpq1CAepUdP2O85LzVgmexiKT6asG40JceMALKTRRRJAseiYsjWqhUGhNeVKrFVW3ieSP6O+PQiAgsIBgjus2KD7+25X5EAZgeUWxbECQLIyyKA6bazIVBMca23DFQsoEsmZTTf7VYukX49f8vKvxDhTbfWQX8q9mJ90iCbOjz01T1HtBAYu+tlm7tymfQo+PQDBEPrc5gR3b3f8uZlu/yX8X7HfOatDisy68jSzHEYrsKOslVteJ+bIumCNrvKzVslvNVGrdV0v/bbbe6pOX9NOvk3k4U+VVZsLjKnY6PEB/fxgCxfZs1sZoWOnwIzKP6n6lUk1N7wlP8fhDJUCYx3nrmIKkt0NSdizTFlStUdNUf44DauMlR+GspqlwxIJnDrwUhTEK5MZGPzowJyUjBNYIsPnfjz/MB+O3fh7+fygD+P6oBq38uV3ozGZrBQZD9dwXn7UsSBYkPrZCXT9RB79N6kipiXik1obihCB4AHUSG+yBih7tQoDrz/G/PCWmxuJZDvUCwQboz2qLauV3o6SMuTIT6D+C337OtYMi5zu0IF5fjp3knOS/eFPiYaU2WNQEx6g+d+fTbvlNO1R9ihdC4Z+MAFaDpnY/EX+oBAjKUmo1HSN9uxW4dQL9BxZtYOxar3lxhxYU8IlY3jET96GRPg60jEWADSAKjlKfYrkp+KMR4C4gDkEiHMflKAYQBK3BCHLeNazQ/5PXngPDN1T0t7WgaUvvzn213ghPOt9UXqzVVV4Ui7N6SMZLs99ab6GoYMyDBdwf2GJTAoUIgZ0IYAkQvED/dNr4IZDfzApjNmAzIXCoCrSuJwsh0G2MjEZpocL9KcEA4I8Cy3UOLcipBd4bpr938Qhp2uMZN5qnrfoImeZdvanAkMAAbziFWiPHvlMQmCwZBG4k8d2J1KogO+k/AUA/7g+mhtjoyfptNnKmUO0t/tYORaHT/pt/DoYMerk6HA7+zJW2M9MHMduYUMx9IIAPYrAxLobI1ObC3w8PCn8KLRrWcCoDHKkCpVZFkYTA7SHQN97qr+FqCARwm9pGkgCpsFDkHSDwqQTY1Yc/c/hKJjQDjrUBdpVJ8YTAbSFw4EwwMcBtvTZqzaUQwDQwbF/HXiCw/m44cv5EAYFsgEsBTuXcFgLjsYVPIuH8ARugZZ2ekdo+kgCpsFDk3SOQ+CSyrOWbaX0iCZCGCsXdPwLBJ5FsRdn+iyTAfnzo6R0jAP3nAp9E2ss7hoCa/mAIqOHCg8+71Wy+xhPBFBbSpsxIAsRRovDjIBBQ/KY7mAnGxDDuEzPHxAAbjCj0SAj0er3EXkDgAXQwsSCCGOCRXjr1ZYMAqB9zYfwDSEl4hz2Q+BKAJyUG2EBGoUdCgB0Gs54Cwx66uMVXAUEHN7NguD2FAQaD/twyt8FS86Va4+/teIohBL4fgUajgUpB+rzq4JatG8VW6QEnhGxwCgOkUj+KtufYcIIuQuAmEOAaf7wpXPvHN8HBYrjwySkMgKwdIzpuaVNFs/a8uaEQIXBVBFI1frQoEX8iAxCtX/XlUuWfI8A1fn4+QFz7X4fDEk5kgHMkwLxTaJu+qNQ7Rl1GM9y3Zq3jBNvLYe+J5rCd/7BzEZS4qaHXrSABkmudRT069MB9a9WGpf5QD76lT6TE3nKDJvuELlZjYaT3lP4gln59a7Uq7RESw09cNyY8AW7pulME8BEwPD9R4+ERWm8KdLYRjELPkQBqs69ZPaUVUL/VqnaE5nCWIPqo3euAWjMCqkX6Vqu0ZhJnMs5o6mTm6JvP5tcp351Rq1LtdMADUY0ZIdx6dF3s+n8wUseuGQui+zUid/8/qP+Qb4Kvuhju3TGGTrWfHPL3YO9rz2xI59e7M7dkXdcyluWu4zb/Pyl6t1+yDPPgvYjkg6fZN7VQ6IYRCA5IlSDS+fmQqS29KgN4U0co5eM7AaW2MRbpDnuWLGe5juRNZ4qu5nAEeH/EPbyxlAiK71lZtZ3Vx9jUO/mlVnOxFUU/rZzUHBR5+wjgfEjeyCiw3eYTbYDtgs6McYbVZh9f7uzSv22jlsMXDUytN0IZMB90ZI0RbL6gdyyrXtjIhhMao1QGgwqMjUJVroXGyQmlUJabQQDenn+HA34uBmaFoQ6lNu2aEsCXFdmZzAMVhdGfZejiLnEAzX4xHI8rbpMP0rB3J5ZgNXMVLceMV8uav291ECLC1kqfH5MTZhSFYn04rEhGqjzZKp0ibhoBeHvg72fnY1tTWMC7tKBrMgAITq8Jg3Y/RYNPxfZJKTebbqsJWhet8UTrDK0F/zU1c2J/yAMO6dc6fq0eN69RY0mzB8PwhA8oVBP5OB3sQx10c8MIYA4YP9A9fomVofFWX0EFsjvMpym2+3mjjoG/LVQbWp+3SamP67tkAE/BlPVxq9GvqGZJa0c94VpQrQDjIFSW8AgO007gMI3XmK8PK61KJTh0I/C6brlioWVFbtaoAgrcGwK7ZoIT/fh8X6DtD2L2+EBT5wcSVdItIXAyAvEPYvbvC4Q1P1Etf9dfbGfZ7faimChwigTAojcs+0nQOrhC3jjjo/KPDiQmsyATOpX9QuHoKijDT0AgPuPbaEwgEC7GAKlLPhP8cDLEzBI1Z/WT81NGQiBAIFoHiju+M0oqMKdIgNSCKJIQuCkEEjbAWz99b1BigJt6a9SYiyEQX/W5Voc+rALiNV3TDXqxvlJBhMAWAnlVAd1z0sdhGVvPwwhigF3IUPx9I4ADMvhUAL6A0bXiv+OUbxjRw89VoLjj6b4hodb/PAT4yQD9bjthEkRIfM4AUVIKEAL3hQCov157iZ8GsN1+UoG2MaGYR0CAb4MVrYGLAom+kQRIAEK3D4IAVhavZ76Y82c0SvmKHfEkAR7kfVM3TkOAGOA03CjXgyBADPAgL5K6cRoCxACn4Ua5HgQBYoAHeZHUjdMQIC/QabhRrltBAKfAn9MUYoBz0KO8V0bAcQ79nHZXQ4kBdiFD8XeAQL5UOrOVxABnAkjZr4mA5zqY8DqnBWQEn4Me5b17BIgB7v4VUgfOQYAY4Bz0KO/dI0AMcPevkDpwDgLEAOegR3nvHgFigLt/hdSBcxAgBjgHPcp79wgQA9z9K6QOnIMAMcA56FHeu0eAGODuXyF14BwEiAHOQY/y3j0CxAB3/wqpA+cgQAxwDnqU9+4RIAa4+1dIHTgHAWKAc9CjvHePADHA3b9C6sA5CBADnIMe5b17BIgB7v4VUgfOQYAY4Bz0KO/dI0AMcPevkDpwDgLEAOegR3nvHgFigLt/hdSBcxAgBjgHPcp79wgQA9z9K6QOnIMAMcA56FHeu0eAGODuXyF14BwEiAHOQY/y3j0CxAB3/wqpA+cgQAxwDnqU9+4R+H+/1ActJWHpYwAAAABJRU5ErkJggg==) #### Step 2.4: Create users You must create users in Check Point Security Gateway to authenticate to Identity as a Service. This is required to log in to the Mobile Access portal or VPN client and access their applications. 1. On the **Check Point SmartConsole** main window, right click on **Users** 2. Click **User.** ![New User](/assets/images/new-user-6c54a0d61331d35f7905e858fa9cbf94.png) 3. The **New User** windows appears. Select **Default** from the **Choose template** drop-down list. 4. Click **OK**. ![New User Default Template](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAVgAAACECAIAAABahaT3AAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABWKADAAQAAAABAAAAhAAAAABE12ypAAARnElEQVR4Ae2dLXDjypbH+769QFN1t8oBryoCCxpqqhbEYKtiKLBAYTGLwAI9pqlaMGYR1DAPi9gIapiHxWwFHeawMXhAUGYJ2KoILNjT+rIsfyZRbEv6q1Kx1H36dJ9fW0enWy35D1W7ZthAoJUEXpjUSrvLRn9i7M8O75aTcQwC7SBwzl7aYehOK6M/d4pAAASaSiBidC3EJuKivwEDCIAACMAR4DsAAiCAiADfARAAAQwN8B0AARAgAhga4GsAAiAAR4DvAAg0joDEnuhv1axN6SSJ24eruJACAvUm4N0NyYD+l28lMzalk1h5aBBFF9bd7chUchVxiqnLecLrdkrFS4ev0wVpEACBvQmM7m7PWJiI0w4dbiladgSx6PP87Nq62FIKWSAAAqdL4B9fviSN+3F3V9rJs0qtX+sI2NR/kK80XpLFIQiAQB0IPDE5HxdQIJDHApRIWWstWO8IosAfhReD6/NyGVl1Yr2ju5texFTjNgkclgJ+kjH2CCeic8MSTaS/NPpYVp7otEwzqavcEhyDAAhsJVC6+JcOS0U3ThaOnXHvR19/cNwgLUJnpn2rTL5980IWXdy4N+fGNDB7CnucsUuFz5l8ee79mvMLhT2NStWsHkaXqvb0q2/PkqxV5f5PyunIodt35nhIbBUgUkCgQgLrIwKqQJIeLffp+noxayjxM5l1rm/FNfze4OfymTSfz884jSC07tnEn7HPXR6dq102eZjvbKIoq1w7WdCxqjzW8LyPqp11QQAEWkggnyBIbC8dloBsjAhITnrwx1eGpf4qlAm+/+PnJH+IO3qasn5PVrgceM5vpqqcf+6yYJhOVYpyEgvDgluIT/gnn6IMyTe/+FyjyL/z6H6zhcyycrbH+KLQMuyCAAgkBOgeQX7aJ5MFyTQB/acBwtppgo0RgdAozV33gd9cJ2dkFDyFjOs3hYkDae5PaaZAlX9PA7F/1rvuMNovdog0D8LOtZFOPara5fnsMXclwdgZjJ9lfr5GeVEJ9kEABPYmkHuBfF4g38mzSsq2RQRCNPSHY2WoiV0aLNjfzpxbY6SKQzb71XdmAU0QaMrEjS/ojzOuKf6vQgAQC/qOy21jeBf7k/njIJ4XoFkGGl/E+RQIzCVpXlJ+9T3OxD8QAIE3EYhjgfQeQXIfIYkL1ir749q012YgEQRAoKYEkvXFETsrtX9z+suuiKCkCYcgAAInT2DVBSRN3pROuVvnCE7eYDQQBECgEgJwBJVghBIQqDcBOIJ69x9aDwKVEIAjqAQjlIBAvQnAEdS7/9B6EKiEAO4aVIIRSmpJYO1rfGppyesaLZF46TcdlhyBLHd0TeWyfH7eeZ1mSIMACNSEwGxOy/6Dsf8QBIs1wP+i/IeatL93odj//V//Jv/9r7+Ew8AGAiDQSAJ//4tx+ew/e//+r+x/H/8p1gH/yf4vnSOgWOCrgV9DbWS/wygQWE9A0zTO08eLU0dAI4L1skgFARBoLgHjWk0mSlJHQPMCzTUWloEACKwnQEOBJCN1BJgdXM8JqSDQaAKdbD4wdQSNNhbGgQAI7CAAR7ADELJBoA0E4Aja0MuwEQR2EIAj2AEI2SDQBgJwBG3oZdgIAjsIwBHsAIRsEGgDATiCNvQybASBHQTgCHYAQjYItIEAHEEbehk2gsAOAnAEOwAhGwTaQACOoA29DBtBYAcBOIIdgJANAm0gAEfQhl6GjSCwgwAcwQ5AyAaBNhCAI2hDL8NGENhBYOnlpTtkkV0Rgecosn/Ngicpqkgh1ByGAD28L0uR3Vc6+XP8h6n442uBI/h4xis1kBeQmOTqvHnfpxVbG5VAHtz1w8Fo9sO4aJRh+BHUo3QnxQIDDV7gKOzfVWlHkkxVDqPstT7vUnZahTFHcIT+oBEBYoEjcK+iSklqoBcgMBgaVPHtqFRHFEWO49CPT9AO59w0zU4HvzdTKWIoWyEAR7CC5NgJruv6vp+0IgzDp6en4XB47Eah/oYTqNARzF1dc2aCV6SYvmecswere/d55N3wOkL82MbT1X4TlNkshphl0+EW4UxKfEpsYvUG4yxJMT2aj8yOVj4nNslST927+j6vsiflg56jjLy9pFdqQ8KJE6hojiD42e9qc2OabL/tT/cPhzScTlr95+J33D666o+tbs/Tfq2REePmaELbdDLkjt6zJ2vF6Ky2B2NtOJnu5wWKSmJ3o3thMQ37tSdQiSOYu9awO5zeqhkOfmNcZvv4fCWBl5eXV5ZIxdMYI/6IWM/yTD4er/UEJEIug+8TCWRNyZXnO1kOPptAoApHEPj+TFNzL7CM5WXu9rti0915miPCh3T7lo6FGVuTSGONZbGFjFUIOOj6bI7ZbEhKk+SymLiAuw9pM6jGINObNWlJIEtcmEHZ6Sb076rOtz6vqlgo271HE4RFobfPFHJVU8Z+4gkCT+8lGwUJYlRAGChiMDwRR9HxIlPUTUMMPc4p7bNPhbKbwg2hoM7bYHmrsymvaHsVjoCqU5a/vIsGzL7fMYcGDENt5tzFZ++D1Rfhg9hGg+mgH4f06xL9O4eLorTFsQbJ3PdH8fGQ3eVuhV3aU0djyoCybIpD1ootmjEadC32XWhZNImamwmMBpFjlkYZVEG8Odr47mewT3UL+9+wpy771Kurq1cqWb2/NbH0seZNxZhhyFxPtiZDlQYRHo0MhNPpWSKH8tSx4wV58XyHRNL9F6bmZclbvLJh9RAvTs0W9+vR+re2siJHMCv80vpSUxTLpllDxtQrjcU/xy7+ZeEDvxlomxP5Zz42FxfXIJgll326Og/GGytcL1ZshnKlihYtmiQOMoG8SSIx2/wkJKC4I42LswwKZFZapdq/xUTp2ze6OBejAPrJ2rfrihQuSzF4uv53xWWf0M1WxvdpSEBhAjZBIDn/2+MFyOQq7hpwVVWGvm9fbhgdvPHLxW9G05s4jJ/1aQKC01VJc+KL/naFK2KFYcT2kiJ3/rs06Rj81AciqLlkNFT5uqpgpbpVkdelPMdbXoY8paKkv12dJ27dybxV4I8DbvKICYvUIZ3ti2LJgCGWpFHDIBpOJr0o9IyBmD1It3yHjvP91Z1MvFmfrfIC1HWVRATnhqFRyF0c8Lubzj4xAh6nt8mDn3fjODpYmxh/sbjhjUzldzCnuS0qWBgRbPje7SlWLj279+cibXW+I/j9mAx86Lya5adBVn61uvfNEdAKAtu2M+3ikxYXjcf5PcFizvb9ia07ih2f/JwrzHfdkofLigtPw8ldsJAcR5xI65iUOFKjo3xJQyaOz0YSqCIiIDCqPR197tN0XQwpXkewCdelPRpkknwwGsW3F9YlUkCe3hSnQOCcsfO4oNZ1Ys1LwcHllWaa/e4wTlwR29SSYrrCg6/drriBT9HH0h0P9ctXVxO1KpqmJEPlrdW9NSyiu4Z0FXp8fCw2i/ZpTREtMaIRvGVZO9a3RhQ0iSnAmBBNAUyyZQTiDoKu6z031k3BgVWopGcYXr+vuoxrGo8NlGRD13pWT7gfTUsNWvjAnqYOBlRLKcgoqMRu7Qj8cW2K68/o7rZ2Ta+uwXQj4KALn66c2chYujVAttB5XlpKVDKQBgilYKEkgMPDEOi7wb35qsHaYdr1xlr0LzQelP4msReJPb1RRxOK0aOl549nny6en49rzXYvQG3bKXDc9qP2WhOoaGhQawan0fjRaHQaDUEr2kgAjoCeMe/c/8+PQ3Y+DcRpRmDHgP+QDUJdexPY/IzI3ipOUrCSuwYnadkJN4ped0UvunnPMwUnbFyTm0ZdNp6G8uJmanOMRURwhL60+tzyAjy4cwT0766SvMBtvzzR+26tx1cAR3CEPjjvdH6YTXvp3RE4osrqCGBoUB1LaAKB2hKAI6ht16HhIFAdATiC6lhCEwjUlgAcQW27Dg0HgeoIwBFUxxKaQKC2BOAIatt1aDgIVEcAjqA6ltAEArUlAEdQ265Dw0GgOgJwBNWxhCYQqC0BOILadh0aDgLVEYAjqI4lNIFAbQnAEdS269BwEKiOABxBdSyhCQRqSwCOoLZdh4aDQHUE4AiqYwlNIFBbAnAEte06NBwEqiMAR1AdS2gCgdoSgCOobdeh4SBQHQE4gupYQhMI1JYAHEFtuw4NB4HqCKQvL314DCR25J/6qc4oaAIBENiLQMQ6iVzqCBSFd5If+NyrOIRAAASaQOA5+21bDA2a0J2wAQTeSQCO4J0AURwEmkAAjqAJvQgbQOCdBOAI3gkQxUGgCQTgCJrQi7ABBN5JAI7gnQBRHASaQACOoAm9CBtA4J0E8GvI7wR4nOJRFDn+8zR4avMiMFoK81mWTFXubFgDQ5Qmk0kQBFF2t/w4vXXUWiWJybLc66mbKCWtgyM4ai+9tXLyAoosfdWUtypoSLmH2fPQD+1rvtYe8gJnZ7Kqqmtz25NIrtD3x9fX11tMxtBgC5zTzaJYQLtIF4eebis/vmWXSucx3Hi5pxPg4qLtvpI6gXMehuH23oAj2M7nRHPbPCLYv0vaPCLYn1IiCUfwWmKQB4EGEoAjaGCnwiQQeC0BOILXEoM8CDSQAO4a1LVT6d7YoZs+sXuDcVKpYnquLubqJTYZ9Bxl5OkyHYWeceXwu4nVO3TbNtT3MZRiM2fiuf1IMe/d2PQNDXht8jLP15Z+uzwcwdvZtauk8AIzczTJT3iDjRJfkHOY2H1fJYn1N/NysXrvhJ7ed5ThdJL4utDzJkw/Fb/3drQYGrydXZtKhp77Sxsml32yW9atr5HjTuiSmFCIWOAZAzYsuYbGIQo967syLEQ8sl6tF8h5HhgdHMGBgdezusAfzzS1eN3jqsbDIEjNiSa27vdGJzMi+CjKqxyymihgSjeb3CNt5Cx010tTDS8jJUZP3UQyFQw8fblkpvKgn3AEB8Vd48q4Uo74pccgXqUiscB1xpphiFmCxm+rHGKTexatY6RtqI4dj14AKmZPAnemxmnaLI6ekjkUMXqKt9htTix9rHnTWIy5C39x6BcHYo6g8d/cigwMZnRRWzrVI4XL8YQZ46atjQe65410fvApzIrs21fNKoek5GImlSeLGSPCYqhi8NSjRc5OEEg9JgIr0y14VFr8yAJf7zqJkuOthkZEsO8XoNVytGBf8X2/wICC5ICWrmanPdc9W3H0QRIWF+SatbvKIbGPwvtBNKTLuj8yxWmeYVnsFBNLTFRRMNnsfPSVaygJf9QhHMFHkW2UXkk2dG1sWdl5TlMCjmQY+ddWGKtanhEODHfz2v/6I0k59OzcJwaemDKlC7sSe8WQ/ONmM2M/4roFCU7hg7+Usrn0h+ZgaPCheBukXLUmtpj6SkzS7IlLYS9thUsXN9xh0OubbOQY8aAhkW3Wf+LgcbpVkIJQjJEI6w3D6/dVl3FN4/HwvoBlgYj8iDMMVb3nCibE0FJ7lmfqpC5OYRQcWMfB9ceNeUud6QyHG57pPk6zUOt2AlfObGQUhprbpRud23eDe3P9I4aO4xqG3mjr9zXOdV3TNFel6XcNzMGAZjYxNFiFgxQQaB0BOILWdTkMBoFVAnAEq0yQAgKtIwBHUMsux8uJ9uo26dNeYhBiDI6glt8CemnnJChOTNfSivc3OggjfrZxER6XO2LBTuu3MHymdzdux4Dbh9v5nGguvbrXHoff/bb7AvIClrrxK043O2kVlO9nqx9OtDM/ulkReQFNU7dXA0ewnc+J5tKrqYc3uH24o3c6nc72V/fuKN+mbAwN2tTbsBUENhCAI9gABskg0CYCcARt6m3YCgIbCCSOQHpq+6zTBjxIBoF2EEgjgvE4fSllO6yGlSAAAoLA5HGWgBCOIGKffEqYpUlJBv6DAAg0m8B8/ux6vyJ2RmYubh9ajkc/F9nX1I3rM5pN5YDW4UHPA8Jue1X0fOHazX8MPI8efk4XX4rHkCkiiEVf6L+0eHh6bXEkVkAg8cEVKIIKENhFQGJPa0UiOtfFJs59ib1QRBAthwDLR7Es/oEACNSWwPozOksVl39yAv8PbqpLbCPFGNcAAAAASUVORK5CYII=) The **New User** page appears. ![New User Page](/assets/images/new-user-page-cde6e8c46593ab17b723904070f7e5f1.png) 5. Click **General**. 6. Enter the following user information: - user name for example: **user1** - the mobile number - email address. 7. Click **Authentication**, and then do the following: 1. Select **RADIUS** from the **Authentication method** drop-down menu. 2. From the **RADIUS Server** drop-down list, select the RADIUS object you created in the section _Step 3: Create a RADIUS server object_. 8. Click **OK**. #### Step 2.5: Create a user group A user group is a group of users with either related responsibilities or who perform related tasks. You can specify a user group in policy rules in the same way you do for individual users. note Creating a group is necessary if you want to allow some of your users to do certain things but not others. A firewall does not allow you to define rules for individual users, but you can define rules for groups. 1. On the **Check Point Smart Dashboard** main window, right-click **Users.** 2. **Click User Group**. ![New User Group](/assets/images/new-user-group-0357f59e5cafeab077d7b75ef3658c16.png) The **New User Group** page appears. 3. In the **New User Group** page, do the following: 1. In the **Name** field, enter a name for the user group, for example, Identity as a Service_Users. 2. Click the **+** sign, in the list of **Available Members.** 3. Select the members that you want to add to the group 4. Click **+** next to the user. The user is added to the user group. 5. Click **X** to close the user list window. 4. Click **OK**. You have now created a user group and added to the group. #### Step 2.6: Set the topology Setting the topology helps you define which interface leads to which network. This setting is done manually with the network or group object so that it represents the network or subnet behind each port. This procedure describes how to set the topology for both internal and external networks. #### Set the topology for the internal network 1. Go to the **Check Point Gateway Properties** page, double-click **CheckPoint Gateway**. The **Check Point Gateway Properties** page appears. ![Check Point Gateway Properties](/assets/images/check-point-gateway-properties-cde7ef89bdff4cbc15fcee79dc4fd25a.png) 2. In the left-pane, click **Network Management**. 3. In the right-pane, click **Get Interfaces**. note If you see **Topology** and **Anti Spoofing** warning dialog boxes, click **Yes**. ![Get Interfaces](/assets/images/get-interfaces-a871c0eb1869a2f6f1c4fb8b24c63daa.png) The **Get Topology Results** page appears. ![Get Topology Results](/assets/images/get-topology-results-8643d3aac1a2d4b94b29e191862bac2f.png) 4. Click **Accept**. ![Interface List](/assets/images/interface-list-37e7151671c225c0013a78c41f9d19bf.png) The interfaces appear with default topology settings. 5. Optional: Modify the interface settings if they do not match the settings of each machine configured on your PC. 6. Optional: Define the topologies for each machine if they have not been defined. 7. Select **eth1**. 8. Click **Edit**. The **Interface Properties** page appears. ![Interface Properties](/assets/images/interface-properties-9aef1507ef1f558c99909e7a65168797.png) 9. Click **Modify**. ![Modify Interface](/assets/images/modify-interface-66792d1bea54ca2f003cbb689f9a6446.png) 10. In the **Interface Topology Settings** page, do the following: 1. Select **This Network (Internal)** to lead to the local network. 2. Select **Perform Anti-Spoofing based on interface topology**. 3. Select **Detect** from the **Anti-Spoofing action is set to** drop-down list. 11. Click **OK**. 12. Click **OK** again to close the eth1 topology page. #### Set the topology for the external network 1. In the **Network Management** right-pane, in the list of topologies, select the external network you added previously, for example, **eth2**. 2. Click **Edit**. 3. Click **Modify**. ![Modify External Interface](/assets/images/modify-external-interface-023a9164153ff25d23208833a968fa0f.png) The **Interface** **eth2** **Topology Settings** page appears. ![Interface Topology Settings](/assets/images/interface-topology-settings-fd12f44f85426eeb29691a064789386b.png) 4. In the **Interface Topology Settings** page, do the following: 1. Select **Internet (External)** to lead to the Internet. 2. Select **Perform Anti-Spoofing based on interface topology**. 3. Select **Detect** from the **Anti-Spoofing action is set to** drop-down list. 5. Click **OK**. 6. Click **OK** again to close the interface properties. note If the Management interface **eth0** is set to **external**, set the interface to **eth1** before making changes. ### Step 3: Configure Check Point Mobile Remote Access Check Point Mobile Remote Access allows users to connect to corporate applications over the Internet with a PC. The solution provides enterprise-grade remote access through IPsec and SSL VPN, allowing you simple, safe, and secure connectivity to your corporate email and corporate applications. Complete the following steps to configure Check Point Security Gateway: #### Step 3.1: Configure mobile access 1. On the **Check Point Smart Dashboard** main window, double click on the Check Point Gateway. ![Check Point Gateway](/assets/images/check-point-gateway-cde7ef89bdff4cbc15fcee79dc4fd25a.png) The Check Point Gateway properties page appears. 2. Select **General Properties**. ![General Properties](/assets/images/general-properties-7cc98cdee1faa542c3360c5c7e2ae39c.png) 3. In the **IPv4 Address** field, enter the IPv4 address of the external interface for remote access. 4. In the left-pane, select **Mobile Access** from **Network Security (1)**. ![Mobile Access](/assets/images/mobile-access-d7b3ec2b2d5bde6e343b8d9bf02f6e21.png) 5. On the **Mobile Access** page, click **Next**. The **Web Portal** page appears. ![Web Portal](/assets/images/web-portal-c67cadda9747e069b073434f0e45d378.png) 6. In the **Web Portal** page, select the Mobile Access portal URL from the **Main URL** drop-down list, and then click **Next**. The **Applications** page appears. ![Applications](/assets/images/applications-37727cec50e8fc99b78e35e20d8d86b8.png) 7. In the **Applications** page, deselect **Mobile Mail**. 8. Click **Next**. The **Active Directory Integration** page appears. ![Active Directory Integration](/assets/images/active-directory-integration-37727cec50e8fc99b78e35e20d8d86b8.png) 9. Select the **I don’t want to use active directory now** check box. 10. Click **Next**. The **Application Test** page appears. ![Application Test](/assets/images/application-test-0e9ec3d1c1ea5c76864bb9a9d45de17b.png) 11. In the **Users** page, click **Add**. Select the Identity as a Service user group you previously created. 12. Click **Next**. ![Now Active](/assets/images/now-active-22007f0519902722bde1456f91dae939.png) 13. Click **Finish**. ![Finish](/assets/images/finish-c19688d6573262187cbce207b1c66d68.png) 14. Click **OK** on the **Check Point Gateway -- Checkpoint-VPN** page. #### Step 3.2: Configure the portal settings You need to configure the mobile portal so that the remote user is able to access it through an external IP address. 1. Go to **Check Point Gateway Properties** page, in the left-pane, click **Mobile Access > Portal Settings**. The **Portal Settings** page appears. ![Portal Settings](/assets/images/portal-settings-8f6c1de538b529c61370de73994dc40a.png) 2. In the **Main URL** field, enter `https:///sslvpn` 3. Click **OK**. #### Step 3.3: Configure RADIUS authentication for mobile access For a user to connect to the corporate applications over the Internet using the web, a mobile device, or a desktop computer, the user needs to authenticate first in order to have access. 1. Go to **Check Point Gateway Properties** page and in the left-pane, click **Mobile Access > Authentication**. The **Authentication for Mobile Access** page appears. ![Authentication for Mobile Access](/assets/images/authentication-for-mobile-access-45995d47334f58520eb77399f5ffcc1d.png) 2. In the right pane, click **Settings**. ![Single Authentication Client Settings](/assets/images/single-authentication-client-settings-18650cfcb8b6e087f7f8cf5b252f2206.png) 3. Under **Authentication Method**, select **RADIUS**, and then specify the RADIUS server you created earlier. 4. Click **OK**. 5. Click **OK** again at the **CheckPoint Gateway Properties** page. 6. Click **Install Policy** to apply the configuration changes. ![Install Policy](/assets/images/install-policy-d541b8c1eca48d7df8ccabebe39a5497.png) The **Unpublished changes** dialogue box appears. 7. Click **Publish & Install**. The **Install Policy** page appears. 8. Click **Install**. #### Step 3.4: Create the mobile access policy The Mobile Access policy applies to the Mobile Access portal. Users can access applications remotely as defined by policy rules. 1. In the **Check Point SmartDashboard** main page, click **Mobile Access**. 2. In the left pane, click **Policy**. The **Policy** page appears. ![Policy Page](/assets/images/policy-page-44944a697859d17d0c0cc5d0b803131e.png) 3. In the **Policy** page, click the ![Add Row Before](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB4AAAAbCAIAAADkn6hGAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAAHqADAAQAAAABAAAAGwAAAAACobh1AAABbUlEQVRIDbWVr1eEQBDH93xXaNAkEolno1ptZySezYgNolEjzY1GozSo/AdcJG7UBg2HW968OZxbn7xlA/fd2dnP/LjhsRmGQayztoBt2zbPc/v8pmmSJFFKQfp211ZKmWWZ67p939tN/Apwa3ABO6ItLlr6+DfCoqb48KSNhue7fNGn4IxaWxA1oWeU8DYBy7F6/fx400d1XUdRpPXd/YMW5iSWN8TMhdjL0bM+6Drok28ItEI7Ye2nraQ3QQPdkDuD/jMdGsDgvLwhNACrp6xxYsDp8JixrpeMMn9mj5iGgJ95+NhB/E1fsSErovmGfCulC4TasdJLGh1mgke7vg9+6ijw5ab9pVqI+bBjgAnddR2a/ivoXcdxcMtkHcf762DM+sbfY5ggCFgNzmgHgVzQDDrahUJ8wVmwC+GziTdZfXJGlzOx4oSMaHgVPc87i2hlU5ZlmqZ2v+WatoGfoiiqqrKSKIWMaLq3qH8AxiYyQMyNzVsAAAAASUVORK5CYII=) icon. 4. Under the **Users** section, click the **+** icon. 5. Add the RADIUS Users Group that you created in the section Creating a user group. 6. In the **Applications** column, click **+** icon, and then select the application that is selected by default, for example, **Corp_Web_104.21.20**. ![Policy Applications](/assets/images/policy-applications-ad1d59658e6343284febf00cd472cad2.png) 7. In the **Install On** column, click **+** icon, and then select the Check Point Security Gateway, **checkpoint-VPN**. ![Policy Install On](/assets/images/policy-install-on-0dc83f607e611ebd0112febfe5b5b520.png) #### Step 3.5: Configure the remote access VPN (IPsec) 1. Go to the **Check Point Gateway Properties** page and in the left-pane, select **General Properties**. 2. Under **Network Security**, select **IPsec VPN**. ![IPsec VPN](/assets/images/ipsec-vpn-befb4a6cf5dcc53ee0cc999a2f4bde47.png) 3. In the left-pane expand **VPN Clients** and select **Authentication**. The **Authentication for VPN Clients** page appears. ![Authentication for VPN Clients](/assets/images/authentication-for-vpn-clients-befb4a6cf5dcc53ee0cc999a2f4bde47.png) 4. In the right-pane, click **Settings**. The **Single Authentication Client Settings** page appears. ![Single Authentication Client Settings](/assets/images/ipsec-single-authentication-client-settings-b21336b7eeaefed37dcca138c730b204.png) 5. Select the **RADIUS** radio button. 6. Select the RADIUS Server object that you created in the in [Step 3: Create the RADIUS server object](#step-23-create-a-radius-server-object). 7. Click **OK**. 8. Click **OK** again on the **Check Point Gateway** properties page. #### Step 3.6: Configure firewall rules for remote and mobile access VPN Check Point Security Gateway should have at least one firewall blade installed that serves as an entry point to the corporate network. The firewall rule is a policy definition of what is allowed and what is blocked by the firewall. Rules use objects. For example, networks objects can be used in the source and destination of rules. 1. Click **Security Policies**. 2. Under **Access Control**, select **Policy**. ![Security Policy Page](/assets/images/security-policy-page-7203c7cc4a605fbe694d73e643e4fce3.png) 3. In the **Action** column, right-click and select **Accept** from the **Edit Properties** drop-down list. ![Accept Action](/assets/images/accept-action-de1681a0494876cde96459f2ed4ef641.png) note A sample firewall rule to allow any traffic for this integration is available by default. Refer to the Check Point Security Gateway documentation to define the various types of policies to allow specific applications, services, port numbers, and user authenticators. 4. Click **Install Policy** to apply the configuration changes. The **Unpublished changes** dialog box appears. 5. Click **Publish and Install**. The **Install Policy** page. 6. Click **Install**. #### Step 3.7: Install the policy The policy installation process does the following: - Performs a heuristic verification on rules to ensure that they are consistent and that no rule is redundant. - Confirms that each of the Security Gateways on which the rule is enforced (known as Install On object) enforces at least one of the rules. - Converts the Security Policy into an Inspection Script and compiles this script into an Inspection Code. - Distributes Inspection Codes to the selected installation targets. To install a policy: 1. In the **Check Point SmartDashboard** main page, click **Install Policy** on the top icon bar. ![SmartDashboard Install Policy](/assets/images/smartdashboard-install-policy-8b7c3c4e3cf3c5c7e3cd4b5b0aa23fed.png) The **Install Policy** page appears. 2. In the **Install Policy** page, in the **Network Security** column, select the option for your device (for example, **Checkpoint-VPN**), and then click **OK**. ![SmartDashBoard Install Policy Page](/assets/images/smartdashboard-install-policy-page-16bf0d8fd430f6e295e54724c456c341.png) 3. When the installation has completed successfully, click **Close**. ![Installation Complete](/assets/images/installation-complete-9cffa350ea2eaae94f9ef086602999ba.png) ### Step 4: Add Check Point Security Gateway to Identity as a Service #### Step 4.1: Add Check Point Security Gateway to Identity as a Service note Entrust recommends that when multiple RADIUS applications are configured that each RADIUS application is given a unique shared secret. 1. Click Menu icon **>** **Security > Applications**. The **Applications** page appears. 2. Click **Add**. The **Select an Application Template** page appears. 3. Do one of the following: - Select **RADIUS and VPN Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS. - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS. 4. Click **Check Point**. The **Add Check Point** page appears. 5. Optional: Edit the **Application Name**. 6. Optional. Enter a **Description** for your application. 7. Optional. Add a custom application logo as follows: 1. Click Circle Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears. 2. Click Arrow Up From Line icon to select an image file to upload. 3. Browse to select your file and click **Open**. The **Upload Logo** **dialog box** displays your selected image. 4. If required, resize your image. 5. Click **OK**. 8. Click **Next**. The **Setup** page appears. 9. Click **Add** to next to **Hosts** to add the host name of the VPN server. The RADIUS agent receives the request on this host. The RADIUS Agent on the Gateway determines the RADIUS application the request is for based on the host name and port. 10. Enter the host name in the **Host** dialog box and then click **OK**. Repeat this step to add more host names. 11. In the **Port** field, enter the port on which the RADIUS agent accepts messages. tip Do not enter `8443` as the port number for this application. Port `8443` is used by the Entrust Identity Enterprise agent in your Gateway. attention The RADIUS agent uses the host name that sent a request and the port number that it received the request from to determine which RADIUS application made the request. Because of that: - Two RADIUS applications with the same port value cannot share any host names. - Two RADIUS applications that have one or more matching host names must have different port values. 12. In the **Shared Secret** field, enter the shared secret that is used by your VPN server. This is the RADIUS secret shared between your VPN server and the RADIUS server. The shared secret value must match a shared secret in your RADIUS client. 13. From the **Select** **RADIUS Agent** drop-down list, select the name of the Gateway containing the **RADIUS agent** to which this application will be assigned. 14. Optional: From the **Select RADIUS Attribute for IP Address** drop-down list, select the RADIUS attribute that corresponds to your IP location. 15. In the **Challenge Response Queue Max Time** field, set the number of seconds that the RADIUS agent waits for a response to first-factor authentication. The default value is 180 seconds. 16. In the **Challenge Response Queue Max Size** field, set the maximum number of second-factor challenge requests allowed in the queue of your RADIUS application. The default value is 1000 requests. The maximum value is 10,000. 17. In the **Request Cache Timeout** field, set the number of seconds to cache requests. The default value is 10 seconds. 18. From the **Character Set** drop-down list, select the character set used to decode and encode string values (including the user ID and password values) in RADIUS messages. The options are UTF-8 and ISO-8859-1. 19. Optional: Select **Log RADIUS messages** to enable RADIUS message logging. When enabled, messages for the RADIUS agent are logged to the same log file as the gateway logs. 20. Optional: Enable the **Authentication Settings**. 1. Select **Enable Push Authentication Fallback** if you want to authentication to fallback to another authenticator in the event of a failure. If required, set the **Push Authentication Fallback Timeout** to the number of minutes before the push authentication times out. 2. Select **When authenticating the user will be asked to select their second-factor authenticator**. When selected, after the user responds to the first-factor challenge, they are prompted to select their second-factor authenticator. The list of available second-factor authenticators is set by the resource rule. 3. The following is a list of supported strings matched to the authentication types: - Grid: grid - Knowledge-based Authentication: kba - One-time password: email, sms, voice - Smart Credential Push: scpush - Temporary Access Code: tac - Token: token - Token push: push 4. Select **Indicate if requests must include the message-authenticator attribute for incoming messages** to include the message-authenticator attribute for incoming messages. 5. Select **Indicate if requests must include the message-authenticator attribute for outgoing messages** to include the message-authenticator attribute for outgoing messages. 6. Select **Remove domain from user ID for incoming requests** to remove the `domain` value from the user ID during authentication when the user ID provided by the RADIUS client is in the format `domain\username` and the user ID in IDaaS is in the format `username`. 7. Select **Indicate if Active Directory password authentication requests are handled by the same Gateway Instance that initiated the request** to require that Active Directory password authentication and change requests that are initiated as part of the RADIUS authentication are handled by any Gateway Instance in the same Gateway cluster that initiated it. If disabled, the request is handled by any Gateway Instance. 8. Select **Enable one-step multi-factor authentication**. When enabled, the user enters their user ID and then their password and token response in the password field. If you select this option, second factor authenticators available in the resource rule are limited to token and temporary access code. 9. Enter the **One-step multi-factor authentication security token length**. This is the length of the token or temporary access code response if you enable one-step multi-factor authentication. 21. Optional. **Add Response Attributes**. Response attributes are returned to the RADIUS application after successful authentication. Use this setting to configure RADIUS attributes to return information such as the user's group information to the VPN server. When adding response attributes, you optionally add group filters. For example: example Users in IDaaS may belong to one of the following groups CANADA, US, UK, FRANCE. The VPN server wants the FilterID attribute returned from the IDaaS RADIUS agent to be the value NA or EUROPE, depending on whether the user is in NA (Canada, US) or Europe (UK, France). To do this, use a RADIUS attribute filter for the FilterID attribute with a Groups value with the following filters: - match CANADA, replace NA - match US, replace NA - match UK, replace EUROPE - match FRANCE, replace EUROPE 1. Set the **Response Attributes** as follows: 2. Click Circle Plus icon **Add**. The **Add a Response Attribute** dialog box appears. 3. Select the **RADIUS Attribute ID** from the drop-down list. The option you select depends on your VPN vendor. 4. Select the **Value Type** from the drop-down list. 5. TTo return a static value specific in the RADIUS attribute definition, select **Static** and enter a **Value** in the field and then click **Add.** 6. To return the user's group membership, select **Group** and then optionally do the following: 1. Click **Add** to add filters. 2. Enter the **Match** and the **Replace** attribute filters. 3. Click **Add** to add more attribute filters. 4. If you add multiple filters, you can drag and drop them in order of preference. 5. Select **Stop after matching filter** if you only want one the filter to return one value. Using the example above, if you want NA to have preference over Europe, make sure to list Canada and US in the list of filters. 6. For Multiple Values Per Attribute, enter the **Value Separator** and then click **Add.** info If a user belongs to more than one group, you can either add a separate attribute to your RADIUS response for each group or you can combine all of the groups into a single attribute. For example, if the user belongs to G1,G2,G3 then you would - return a RADIUS response with three attributes - return a RADIUS response with one attribute and a value like "G1,G2,G3" where the , is defined in the Value Separator setting or a value like "G1 G2 G3" where the Value Separator is defined as a space. attention The default group separator is a space. If you have group names that are separated by a space, use another separator, such as a comma. 7. Repeat these steps to add more response attributes. 22. Optional: Configure the **EAP Settings** to set up the application to use the EAP RADIUS authentication protocol. 1. Select **EAP Enabled** to allow the RADIUS application to accept EAP messages. - When enabled, authentication messages with EAP content are treated as EAP requests. The application can accept only EAP authentication requests. - When disabled, incoming authentication requests are processed by the RADIUS application as a standard RADIUS authentication request (even if the request includes EAP content). In this case, the application can accept only standard RADIUS authentication requests. 2. Select the **EAP Protocol** from the drop-down list. The options are PEAPv0 with MS-CHAPv2 and PEAPv1 with GTC. 3. This setting defines the type of EAP authentication protocol that is performed on EAP requests received by the RADIUS application. Consult the configuration requirements of your VPN server to determine which EAP protocol to select. 4. Select **Return MPPE Keys** to include the MPPE (Microsoft Point-to-Point Encryption) recv and mppe send keys in the Access-Accept message returned during a successful EAP authentication. The setting is enabled by default. 5. Select **Use PEAPv1 label when calculating MPPE Keys** to use the PEAPv1 label when calculating the mmpe recv and mppe send keys. 6. Leave the **Minimum TLS Version**, **Maximum TLS Version**, and **Allow Weak Ciphers** at the default settings unless you have an older VPN and need to configure these settings to allow older versions of TLS or weaker ciphers to interoperate with older VPN servers that do not support the latest versions. 23. Configure the **Deprecated Settings** **if your RADIUS application is** connected to a Gateway version older than 3.0. These values are only required for backwards compatibility. 24. Select Token OTP Only, Password with second-factor, or No first-factor as the **Authentication Type.** This setting defines the level of authentication required to access a RADIUS application that relies on a gateway RADIUS agent configured before release 3.1. warning MSCHAPv2 authentication is not supported when **No first-factor** authentication is configured for the RADIUS application. 25. Click **Submit**. #### Step 4.2: Add a resource rule See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md). ### Step 5: Test the Check Point integration Test the integration to ensure that it has been configured properly. #### Step 5.1: Test the authentication using a Web browser (Mobile Access SSL) 1. Open a web browser in the client computer and enter the following URL: `https:///sslvpn` i.e. `https://10.4.21.73/sslvpn` If you are connecting for the first time, the SSL VPN gateway imposes the installation of the Check Point SSL Extender Active X component. This is a virtual interface that encapsulates all the communication inside an SSL tunnel. 2. In the log in window, in the **User name** and **Password** fields, enter the user name that you have defined in Check Point and Identity as a Service in the section Creating a user. ![Login Window](/assets/images/login-window-a79dca09722bc2bd900833f4a00718d9.png) 3. Click **Sign In**. You are prompted to enter a token response. ![Token Response](/assets/images/token-response-11d388f5e0408068292a4a0ea199e40d.png) 4. Enter the Entrust CR Token response to the challenge. 5. Click **Submit**. The user has authenticated successfully and the **Check Point Mobile** window appears. ![Check Point Mobile](/assets/images/check-point-mobile-cdfe48398729edfb029b2edb42217824.png) 6. Open the Corp Web application and verify the web access of Internet network. ![Corp Web Application](/assets/images/corp-web-application-7662794c88a8faa81d5fa0502778b783.png) #### Step 5.2: Test using Check Point endpoint security client (IPsec) 1. Open the Check Point Endpoint Security application. 2. In the log in window, do the following: 1. In the **Site** field, enter the IP address of the Check Point Security Gateway (External Interface IP). 2. In the **Username** field, enter the name that you defined in Check Point/ Identity as a Service. 3. In the **Password** field, enter the password of RADIUS application. ![Endpoint Security Login](/assets/images/endpoint-security-login-7e17dfe947a4c06c6beb2cdb151976ec.png) 3. Click **Connect**. On successful first-factor authentication, Identity as a Service challenges you to enter the response. 4. Enter a response to the grid authentication challenge. 5. Click **Connect**. ![Grid Challenge](/assets/images/grid-challenge-0ba6a55a9bdd00d541de86a88eb45621.png) 6. After successful authentication, you should see a Check Point connection succeeded message. ![Connection Succeeded](/assets/images/connection-succeeded-6f301c504b6cdb9b77d5698b52e9c2e4.png) #### Step 5.3: Test using Entrust Identity push authentication 1. Log in with the correct first-factor username/password on your RADIUS client. 2. **Open the Entrust Identity app** on a mobile device. 3. Unlock (log in) using the identity you want to use to respond to the request. 4. **Tap Actions**. 5. Review the transaction summary details. 6. Tap **Confirm**.