07 Identity Awareness Lab PDF

IDENTITY AWARENESS
R80.10 Training
(revised: September 14, 2018)
©2018
©2016 Check Point Software Technologies Ltd. [Confidential] For designated groups and individuals 1
Identity Awareness Lab
Creating security policy based upon

users is possible using Check Point
integrations with 3rd party user stores
like Microsoft Windows Active
Directory.
In this lab we’ll connect the R80

management server to an Active
Directory server and use this
information in the policy.
©2018 Check Point Software Technologies Ltd. 2

Gateway IP: 192.168.103.1
External Network
IP: 192.168.103.x VMware:
suspend
Kali
Pen Test Tool
Internal Client
Kali
Win-Victim IP: 192.168.103.100
User: root/Cpwins1!
IP: 192.168.101.100
Default Gtwy: 192.168.103.254
User: jroberts/Cpwins1!
Default Gtwy: 192.168.101.254
DNS: 192.168.102.2 Internal Network DMZ Network
DNS: 8.8.8.8 IP: 192.168.101.x IP: 192.168.102.x
Management
&
Gateway
VMware: VMware:
suspend R80 suspend
Endpoint
Endpoint Eth0: 192.168.101.254 Ubuntu Active Directory
Management Eth1: 192.168.102.254 Web Server
Eth2: 192.168.103.254
User: admin / Cpwins1!
GUI : admin / Cpwins1! Ubuntu Win-DC
EndpointServer
Default Gtwy: 192.168.103.2
IP: 192.168.101.165 DNS: 8.8.8.8 IP: 192.168.102.5 IP: 192.168.102.2
User: admin/Cpwins1! User: admin/Cpwins1! User: Administrator /Cpwins1!
Default Gtwy: 192.168.101.254 Default Gtwy: 192.168.102.254 Domain: LAB.TEST
DNS: 192.168.102.2 Default Gtwy: 192.168.102.254
DNS: 8.8.8.8 DNS: 127.0.1.1
DNS: 192.168.103.2
DNS: 8.8.8.8
Enable Identity Awareness
Enable Identity Awareness on

the Security Gateway.
• From SmartConsole, edit the

Security Gateway object
(R80).
• In the Network Security tab,

verify that Firewall option is
selected.
• Select the Identity Awareness

blade option.
• This launches the Identity

Awareness configuration
wizard.

• In the Wizard, enable both AD query and Browser-Based Authentication
click Next.

• If these fields are not
already populated
then create a new
domain “lab.test”, with
credentials
“Administrator”, and
“Cpwins1!”.
• Click Connect.
Note: If you receive an Error, click Connect one more time. Sometimes the first connection attempt is
dropped in a VM environment. Verify the connection with a ping to 192.168.102.2.
• Notice the default is set • Identity Awareness is Now
to access the portal only Active! appears.
through internal
interfaces. • Click Finish. Click OK.
• Click Next. • Install the policy.

• Edit the R80 object. Click on Identity Awareness branch and check the settings for
Browser Based Authentication (aka Captive Portal) and Active Directory Query.
Notice the other identity sources.
• Identity Agents – Lightweight agent

installed on user’s computers.
• Terminal Servers – agent for terminal

servers.
• RADIUS Accounting – identity from

RADIUS accounting requests.
• Identity Collector – remote collector that

supports AD and Cisco ISE/pxGrid.
• Identity Web API – add, delete, show

users via an API.
• Remote Access - for IPSEC VPN users.

• In the SmartConsole objects pane
(upper right), select Servers ->
LDAP Account Unit -> lab.test_AD.
• Verify that the LDAP account unit,

lab.test_AD, was created.
• Active Directory Query should be

enabled.
• Click cancel to exit.

Note: LDAP Account Units define the profile used to
communicate with external LDAP user directories like
Active Directory. This object also contains the
credentials and other settings needed to communicate
with the LDAP store. To simplify the configuration this
object is set up when the IA Configuration Wizard runs.
Test Identity Awareness
• Log off from Win-
Victim.
• After logging
back in, browse
to any site.
• Verify the logs
include the user.
• If you like use
Identity
Awareness Blade
query to see
more details.
• Captive Portal Scenario: This is a simple method to authenticate
users with a web interface. When users try to access a protected
resource, they enter authentication information in a form that
shows in their browser.
• In rules with access roles, you can add a property in the Action
field to redirect traffic to the Captive Portal. If this property is
added, when the source identity is unknown and traffic is HTTP,
the user is redirected to the Captive Portal. If the source identity
is known, the Action in the rule (Allow or Block) is enforced
immediately and the user is not sent to the Captive Portal.

• Open the firewall rulebase and right click the Action field for Rule 5.
• Select More.
• Enable Identity Captive Portal.

• Click OK.

• In the Source column right click and remove the
Net_192.168.101.0 object.
• Click + to open the picker.
• Click new and select Access Role.
New

• Name the Access

Role known-
internal-net-users.
• In the network tab

select specific
networks:
Net_192.168.101.0
• In the Users and

Machines tab
select Any.

• Before exiting, click on Users.
• Click Specific users/groups and click +.
• Notice that you can toggle the icons in the upper right to show just users.
• We could create a specific role, but for this lab select Any User and click OK.

• The Internet Access section should now look like the below,
Critical Risk applications and sites in the new rule 4 and
redirecting web traffic to the captive portal in rule 5.
• Install the policy.

Test Captive Portal to verify
the configuration.
• Log in to the R80 CLI (via

the Gaia web UI or
console)
• From the restricted admin

shell type expert.
• From expert mode, type:

pdp monitor all | more
to get the ip address of
jroberts@lab.test

• Issue the command:
̶ # pdp control revoke_ip 192.168.101.100
• This will revoke Joe’s identity mapping on the gateway.

• To test this, close Chrome.
• Instead of opening Chrome

with 3 tabs, launch Chrome
in a new incognito window.
• Right click the Chrome icon incognito

in the system tray.
• Select New incognito

window.

• Try to connect to: www.cnn.com and you should be redirected to a
Network Login window.
• Using the following information, enter the user credentials:

• Username: jroberts
• Password: Cpwins1!

• If you want to test with Internet Explorer, close Chrome and issue
the “pdp control revoke_ip 192.168.101.100” command again.
• Launch IE and try to connect to: www.cnn.com and you should be

redirected to the Network Login window.
• If you receive a certificate warning, select Continue to this website.
Note: If you receive a warning, click

continue. The Gaia portal cert is
different from the gateway certificate.

• In LOGS & MONITOR, Select Queries -> Access -> Identity Awareness
Blade -> All from the Query favorites.
• Notice in the latest log Identity Source is Captive Portal.
• From Expert Mode, type the following command and press Enter:
# pdp monitor all | more
• Notice the Client Type has changed to portal.

• Edit the Internet Access rule to disable Captive Portal. We’ll use
AD Query for user identity for the rest of the lab.
• Right click the Action field.
• Select More.
• Disable Captive Portal.
• Change the Source field from the Access Role to the Network
object, Net_192.168.101.0.
• Install the Policy.

ADVANCED TOPICS
©2018 Check Point Software Technologies Ltd. [Confidential] For designated groups and individuals
Identity Awareness Best Practices
SecureKnowledge sk88520

IA Deployments (Directories, AuthN servers)
Acquisition Source Description Recommended Usage Deployment Considerations
• Easy configuration (requires
AD administrator credentials).
• For organizations that prefer
not to allow administrator
• Identity based auditing and
users to be used as service
logging.
accounts on third party devices
Gets identity data seamlessly • Leveraging identity in Internet
AD Query there is an option to configure
from Active Directory (AD) application control.
AD Query without AD
• Basic identity enforcement in
administrator privileges, see
the internal network.
sk43874.
• Preferred for desktop users.
• Only detects AD users and
machines.
Agent installed on a Windows • Works with Microsoft Active
• Windows application with
host acquires identities from Directory Domain Controller in
prerequisites.
Microsoft Active Directory large scale environments.
• Locally managed.
Identity Collector Domain Controllers via the • Integrates with Cisco Identity
• See Identity Collector
Windows Event Log API or from Services Engine.
Technical Overview for
Cisco Identity Services Engine • Requires Event Log Readers
comparison with AD Query.
(ISE) servers via the pxGrid API. permission credentials.
RADIUS Accounting gets identity
data from RADIUS Accounting
Requests generated by the
• You must define the Security
RADIUS accounting client.
Gateway as a RADIUS
Identity Awareness uses the data • In environments where
accounting client.
RADIUS Accounting from these requests and to get authentication is handled by a
• You must give the RADIUS
user and device group RADIUS server.
client access permissions and
information from the LDAP
create a shared secret.
server. Firewall rules apply these
permissions to users, computers
and networks.

IA Deployments (Browsers, VPN Clients)
Unidentified users log in with a
• Identity based enforcement for
user name and password in a
non-AD users (non-Windows • Used for identity enforcement
Browser-Based Authentication Captive Portal. After
and guest users) (not intended for logging
- Captive Portal authentication, the user clicks a
• You can require deployment of purposes).
link to go to the destination
Endpoint Identity Agents
address.
The Transparent Kerberos
Authentication Single-Sign On
(SSO) solution transparently
authenticates users already
logged into AD. This means that
a user authenticates to the
domain one time and has access
• Used for identity enforcement
to all authorized network
only (not intended for logging
resources without having to enter
Browser-Based Authentication • In AD environments, when purposes).
credentials again. If Transparent
- Transparent Kerberos known users are already • Transparent Kerberos
Kerberos Authentication fails, the
Authentication logged in to the domain. Authentication does not use
user is redirected to the Captive
Endpoint Identity Agents or the
Portal for manual authentication.
Keep Alive feature.
Note -The agent download link
and Keep Alive options are not
relevant when Transparent
Kerberos Authentication SSO is
successful. This because the
user does not see the Captive
Portal.
• Identify and apply identity-

Users who get access using
based security policy on users • See Choosing Identity
Remote Access IPSec VPN Office Mode can
that access the organization Sources.
authenticate seamlessly.
through VPN.
IA Deployments (Agents, API)
• Identity enforcement for Data
Centers.
A lightweight endpoint agent
• Protecting highly sensitive • See Choosing Identity
Endpoint Identity Agent authenticates users securely with
servers. Sources.
Single Sign-On (SSO).
• When accuracy in detecting
identity is crucial.
Identifies multiple users who
connect from one IP address. A
• Identify users who use
Terminal Servers Identity terminal Server Endpoint Identity • See Choosing Identity
Terminal Servers or a Citrix
Agent Agent is installed on the Sources.
environment.
application server, which hosts
the terminal/Citrix services.

• Integrates with 3rd party
security products, such as
ForeScout CounterACT and
• You must properly configure
Aruba Networks ClearPass.
Create and revoke identities, and the accessibility and the list of
• Integrates Identity Awareness
query Identity Awareness authorized API clients.
Identity Web API with authentication systems
regarding users, IP addresses, • You must create a separate
that Check Point does not
and computers via a REST API. shared secret for each API
regularly support.
client.
• Does system administration
tasks such as quick checks of
users' IP address.

End of Lab
©2018
©2016 Check Point Software Technologies Ltd. [Confidential] For designated groups and individuals 29

07 Identity Awareness Lab PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

07 Identity Awareness Lab PDF

Uploaded by

Copyright:

Available Formats

IDENTITY AWARENESS

Creating security policy based upon

In this lab we’ll connect the R80

©2018 Check Point Software Technologies Ltd. 2

Enable Identity Awareness on

• From SmartConsole, edit the

• In the Network Security tab,

• Select the Identity Awareness

• This launches the Identity

©2018 Check Point Software Technologies Ltd. 4

©2018 Check Point Software Technologies Ltd. 5

• Click Next. • Install the policy.

©2018 Check Point Software Technologies Ltd. 7

Notice the other identity sources.

• Identity Agents – Lightweight agent

• Terminal Servers – agent for terminal

• RADIUS Accounting – identity from

• Identity Collector – remote collector that

• Identity Web API – add, delete, show

• Remote Access - for IPSEC VPN users.

©2018 Check Point Software Technologies Ltd. 8

• Verify that the LDAP account unit,

• Active Directory Query should be

• Click cancel to exit.

©2018 Check Point Software Technologies Ltd. 11

• Enable Identity Captive Portal.

©2018 Check Point Software Technologies Ltd. 12

©2018 Check Point Software Technologies Ltd. 13

• Name the Access

• In the network tab

• In the Users and

©2018 Check Point Software Technologies Ltd. 14

• Click Specific users/groups and click +.

©2018 Check Point Software Technologies Ltd. 15

• Install the policy.

©2018 Check Point Software Technologies Ltd. 16

• Log in to the R80 CLI (via

• From the restricted admin

• From expert mode, type:

©2018 Check Point Software Technologies Ltd. 17

©2018 Check Point Software Technologies Ltd. 18

• Instead of opening Chrome

• Right click the Chrome icon incognito

• Select New incognito

©2018 Check Point Software Technologies Ltd. 19

• Using the following information, enter the user credentials:

©2018 Check Point Software Technologies Ltd. 20

• Launch IE and try to connect to: www.cnn.com and you should be

• If you receive a certificate warning, select Continue to this website.

Note: If you receive a warning, click

©2018 Check Point Software Technologies Ltd. 21

• Notice in the latest log Identity Source is Captive Portal.

• Notice the Client Type has changed to portal.

©2018 Check Point Software Technologies Ltd. 22

©2018 Check Point Software Technologies Ltd. 23

©2018 Check Point Software Technologies Ltd. 25

©2018 Check Point Software Technologies Ltd. 26

• Identify and apply identity-

Acquisition Source Description Recommended Usage Deployment Considerations

©2018 Check Point Software Technologies Ltd. 28

You might also like