Set up Nexus OTP as 2FA for Check Point administration

• Deployed Digital Access, see Deploy Digital Access component
• Installed Check Point security gateway, see https://www.checkpoint.com/products/security-gateway-appliances/

• Log in to Digital Access Admin with an administrator account.

In step 3, enter the IP Address of the RADIUS Client (Check Point firewall) and the Shared Secret Key.

1. In Digital Access Admin, go to Manage System.

2. Click RADIUS Configuration > Add RADIUS Client...

3. Enter General Settings and Attributes. Click the ?-sign for help.

4. Click Save.

Nexus TruID Synchronized is used as an example. Other Nexus OTP authentication methods are enabled in a similar way.

• In step 3, select Nexus Synchronized as method.
• When the default RADIUS replies are shown, click Next. You can also add your custom RADIUS replies or modify the default replies if required.

To add a new authentication method:

1. In Digital Access Admin, go to Manage System.
   
2. Click Authentication Methods.

3. Click Add authentication method..., select the desired method and click Next.

4. Enter Display Name, a unique name used in the system to identify the authentication method.
5. Select if the method shall be enabled and if it shall be visible in authentication menu.
   
6. Register Authentication Methods Server when applicable.
   
7. Make other configurations as needed for the selected authentication method. For more information , click the ?-sign. Click Next.
8. If needed, make settings in RADIUS Replies and Extended Properties.
9. Click Next and Finish.
10. Click Publish.
    

1. Open the Check Point SmartDashboard R77.
2. In the Login window, complete the following fields, and then click Login.
   

   1. Username Enter your user name.

   2. Password Enter your password.

   3. Server name or IP Address Select the name or IP address of the server where Check Point Security Gateway is hosted.

   4. Read only Uncheck this option.

      

3. In the Check Point SmartDashboard main window, in the left pane, under Network Objects, click Nodes > Node > Host.

   

4. In the Host Node window, in the right pane, complete the following fields, and then click OK.

   1. Name Enter a name for the host node.

   2. IPv4 Address Enter the IP address of the RADIUS server.
      

      

1. In the Check Point SmartDashboard main window, in the left pane, under Servers and OPSEC, expand Servers, right-click RADIUS, and then click New RADIUS.
   

   

2. In the RADIUS Server Properties window, complete the following fields, and then click OK.
   

   1. Name Enter a name for the RADIUS server.

   2. Comment Enter any applicable comments.

   3. Color Select a color of your choice.

   4. Host Select the RADIUS server host node configured previously.

   5. Service Select NEW_RADIUS, which is associated with the port number 1812. (Cross check the configured radius port at HAG end).

   6. Shared Secret Enter the shared secret value. (The shared secret must be same as entered in HAG.)

   7. Version Select RADIUS ver. 2.0 Compatible.

   8. Protocol Select PAP.
      

      

Create a user with the defined authentication scheme to be able to log in SmartDashboard.

1. On the Check Point SmartDashboard main window, in the left pane, under Users and Administrators, right-click Users, and then click New User > Default.
   

   

2. In the User Properties window, in the right pane, in the User Name field, enter a name of the user.
   

   

3. In the left pane, click Authentication.

4. In the right pane, complete the following details, and then click OK.

   1. Authentication Scheme Select RADIUS.

   2. Select a RADIUS Server or Group of Servers Select the RADIUS server object you created previously.