Remote access VPN on Dot1.x User

[henockk]

Hi All,

we have encountered with the implementation of dot1.x on our remote access VPN users. Since the implementation, we have noticed that our remote access users are unable to log in using their Active Directory username. Instead, we are required to create a new user for them and add this user in Checkpoint, selecting the RADIUS authentication type.

This has caused inconvenience for both our team and the remote access users. So please anyone who can help me addressing this issue?

FYI we use Checkpoint Firewall for Remote access VPN Termination.

[Rob Ingram]

@henockk 802.1X is only used for Wired or Wireless authentication, not Remote Access VPN, RADIUS can still authenticate these sessions though.

It sounds like your CheckPoint is not configured for RADIUS authentication correctly. Please provide more information on your configuration and how ISE is setup to authenticate the Remote Access VPN users.

[henockk]

@Rob Ingram I know It is only used for Wired or Wireless authentication, However only on 8021.x applied devices are not working using their AD credentials

[Rob Ingram · Accepted solution]

@henockk ok understood. You still need to provide some information on what is configured and what errors you are seeing. Provide some screenshots and errors logs.

[MHM Cisco World]

802.1x is l2 secuirty'

If remote access is connect to your wlc or SW and you have Radius Server then you can auth remote access PC

Then you can use use remote access auth which is L3 secuirty.

If you connect via internet then you can use Radius for username/password auth the remote access' no need 802.1x 

[Aref Alsouqi · Accepted solution]

I agree with @Rob Ingram we need more info to be shared, however, from the description you gave it does seem the CheckPoint firewall is not relaying the authentication requests to the RADIUS server properly.

[thomas · Accepted solution]

Please read How to Ask The Community for Help .

There is very basic information that is required for any troubleshooting.

Please call TAC if you are unable or unwilling to share it with your peers.