1. Integrating RSA SecurID into the Check Point Secure Virtual Network
Why re-inventing the wheel?:
Integrating RSA SecurID into the Check Point Secure Virtual Network
Yasushi Kono (ComputerLinks Germany)

2. Why SecurID Authentication?
It is a two-factor authentication solution.
More secure because authentication is consisting of two components:
(look at the next slide)

3. A PIN (can be alphanumeric, and can be up to 8 digits)
A Token Code, which is a series of pseudo random numbers. This code will be generated by the RSA SecurID Tokens.

4. Example for some Tokens:
SD200
SD520
SD600
SID700
SID800

5. Characteristics of some tokens:
Supports numeric PINs (4 to 8 digits)
Passcode consists of the PIN followed by the token code
SD200
SID800
SD600
SID700

6. Supports only numerical PINs
The passcode will be generated by typing the PIN with the keypad
SD520

7. The Architecture of RSA SecurID

8. If you want to integrate the RSA SecurID solution into your Check Point infrastructure…
Your Check Point Security Gateway is „SecurID Ready“ and acts as an RSA Authentication Agent.
No need to install any Agent software on your Check Point Firewall device!

9. The only thing you have to do on your Check Point Gateway (besides configuring and installing a policy):
Create a subdirectory called „ace“ beneath the /var directory.
Copy the file $ACE/data/sdconf.rec into the /var/ace directory of your Security Gateway.

10. Use SmartDashboard to create a user and specify SecurID as Authentication Scheme:

11. Make sure that SecurID is activated as Authentication Scheme in the Gateway object:

12. Finally, you have to create a policy, which can be one of the following:
User Authentication
Client Authentication
Session Authentication
RemoteAccess VPN Rule

13. But, sometimes, life is not that easy!
You have to create the file sdopts.rec within the /var/ace directory of your Security Gateway.

14. The syntax of the sdconf.rec file is just:
CLIENT_IP=
This modification is necessary about 60% of RSA SecurID configuration out there!

15. I will demonstrate now, how to integrate the RSA SecurID Authentication with Check Point VPN-1 Power:

16. DISCLAIMER:
As you might already know…
I am not responsible for unsuccessfull attempts of integrating SecurID into your environment!

17. Thank you for attending this presentation!