topic Checkpoint pxGrid Integration in Network Access Control

Checkpoint pxGrid Integration

vibobrov — Fri, 20 May 2016 16:21:50 GMT

Hi Folks,

Do we have any guides on integrating Checkpoint with pxGrid for identity awareness?

Thanks

Re: Checkpoint pxGrid Integration

Jason Kunst — Fri, 20 May 2016 16:28:52 GMT

Forwarded to SME to respond

Re: Checkpoint pxGrid Integration

jeppich — Fri, 20 May 2016 16:48:50 GMT

Hey Jason, Viktor,

Currently working on this, will send out a draft when completed.

Thanks,

John

Re: Checkpoint pxGrid Integration

colegiodante — Thu, 23 Jun 2016 20:11:11 GMT

Hi folks,

Any of you could integrate Checkpoint with pxGrid? I am trying and I'm stuck in certificates generation process for both ISE and Check Point Identity Collector.

Thanks in advance.

Re: Checkpoint pxGrid Integration

jeppich — Thu, 23 Jun 2016 23:43:45 GMT

Hey Colegio,

They have not officially been certified with pxGrid. They are working at integrating CA-signed certificates into their solution.

Let's setup a webex next week, we can step through self-signed cert setup. My email is jeppich@cisco.com.

Thanks,

John

Re: Checkpoint pxGrid Integration

tuenoerg — Thu, 25 Aug 2016 21:30:43 GMT

Hi,

Are we any closer on this ?

We have a workshop with a large Danish government service - that is looking into integration ISE and Checkpoint (primarily for SGT use) via PxGrid.

Can anyone help with documentation and list over things that might not work ?

Best regards

Tue

Re: Checkpoint pxGrid Integration

jeppich — Fri, 26 Aug 2016 05:20:17 GMT

Hey Tue,

Checkpoint is still in the process of pxGrid certification, there is no official code available. I am expecting a beta build next week. When i have more details i will follow-up with you. In the meanwhile, what version of ISE are they using?

Thanks,

John

jeppich@cisco.com

Re: Checkpoint pxGrid Integration

tuenoerg — Fri, 26 Aug 2016 06:24:26 GMT

Hi John,

Thank you so much..

At the moment the customer is using 2.0.1 for their remaining ISE installation - but an upgrade to 2.1 is not unlikely.

I would really like to know more when something is available.

Tue

Re: Checkpoint pxGrid Integration

jeppich — Fri, 26 Aug 2016 07:50:28 GMT

Hey Tue,

Yup, absolutely, please email me your contact information.

Thanks,

John

jeppich@cisco.com

Re: Checkpoint pxGrid Integration

Mikael Gustafsson — Tue, 13 Sep 2016 14:36:34 GMT

Hi John,

Also interested in information around this if possible?

I have customer were we are looking in to segmentation right now and Trustsec would be the way to go if it is feasible to use with Check Point.

Cheers

Re: Checkpoint pxGrid Integration

jeppich — Tue, 13 Sep 2016 15:26:40 GMT

Hey Mikael,

No, not yet, Checkpoint is still in the development phase.

Thanks,

John

jeppich@cisco.com

Re: Checkpoint pxGrid Integration

ronnie.rockey — Thu, 24 Nov 2016 01:33:47 GMT

Hi John,

Is there any development on this yet. I have customer where he is trying to integrate checkpoint and pxgrid.

Checkpoint doesnt show any username from the pxgrid service.

Thanks

Ronnie

Re: Checkpoint pxGrid Integration

jeppich — Thu, 24 Nov 2016 02:57:19 GMT

Hey Ronnie,

Checkpoint is still in development. They do not have a productional product yet.

Thanks,
John

jeppich@cisco.com

Re: Checkpoint pxGrid Integration

TomKaspar — Fri, 30 Dec 2016 09:47:50 GMT

Hi Rockey,

I have function testing integration in my lab. I can see idenity from ISE in my Check Point firewall.

[Expert@POC-ISE:0]# pdp monitor user Tomas

Session: 0c4cf14f

Session UUID: {0C46EB3F-088B-5EB5-4025-FE390781F2AA}

Ip: 172.32.255.18

Users:

Tomas@domain.lab{5133fbce}

Groups: ad_user_Tomas;All Users

Roles: Access-Tomas

Client Type: Identity Collector (Cisco ISE)

Authentication Method: Trust

Connect Time: Fri Dec 30 10:01:09 2016

Next Reauthentication: Fri Dec 30 10:31:39 2016

Next Connectivity Check: -

Packet Tagging Status: Not Active

Published Gateways: Local

I can see indentity in SmartViewTracker and I can use Access-role in firewall rules.

Regards,

Tomas

Re: Checkpoint pxGrid Integration

tuenoerg — Fri, 30 Dec 2016 09:56:14 GMT

Hi Tomas,

Is that done with PxGrid ?

If not - how so ?

Do you have some documentation ?

best regards and a happy new year.

Tue

Re: Checkpoint pxGrid Integration

TomKaspar — Fri, 30 Dec 2016 10:35:59 GMT

Hi Tue Frei,

Yes, I am using PxGrind connection to ISE server. I use Check Point application Identity Collector. This collector is connected to ISE and Check Point firewall.

Here is documentation: http://dl3.checkpoint.com/paid/1e/1ea10fa512567972a7aea14df4df90a3/CP_R77.30Hotfix_IdentityCollector_ReleaseNotes.pdf?Ha…

I dont't know is it officialy supported from Check Point. I tried write on Check Point support.

Best Regards,

Tomas

Re: Checkpoint pxGrid Integration

jeppich — Sat, 31 Dec 2016 00:23:52 GMT

Hi Tomas,

Checkpoint is in the process of being pxGrid certified, I am working on the documentation details. When i have these available I will let you know.

Thanks,

John

jeppich@cisco.com

Re: Checkpoint pxGrid Integration

jonaowen — Thu, 26 Jan 2017 01:02:10 GMT

John,

Well done for all the work that has gone into this.

I too have partners here in NZ and AUS who would and are actively seeking this integration.

I feel it is a very definitely tool for us long term, to be able to embed Cisco Security in existing security deployment and fully integrate systems.

Can we work together and achieve the documentation and verify the testing so we can get this out and published?

Please feel free to contact me.

Cheers,

Jonathan

jonathan.owen@cisco.com

System Engineer - NZ

Re: Checkpoint pxGrid Integration

jeppich — Thu, 26 Jan 2017 01:07:30 GMT

Hey Jonathan,

When i have a draft document together, i will send it out you. Currently, Checkpoint is still in the testing phase.

Thanks,

John

jeppich@cisco.com

Re: Checkpoint pxGrid Integration

Tomoo Esaka — Wed, 22 Feb 2017 19:12:32 GMT

Team,

Please send me draft of ISE checkpoint integration doc. My customer is also asking for ISE pxgrid doc for checkpoint 5600 firewall running R77.30 software.