RE: [FW1] SecurID

[Patrick Desnoyers <pdesnoye@FW1-NOSPAMmatrox.com>]

Title: RE: [FW1] SecurID

Well, if you use the generic* user to authenticate your VPN users trough third party software (ACE server), you are limited because "generic* can be a part of only 1 group. So all VPN users have the same access (let's say , e-mail, or access to a certain server) If you dont mind that, it's ok. On the other hand, if you want to create different VPN groups, you'll have to use HYBRID mode IKE, and then select SecurID as authentication. BUT, how will you manage users on firewall-1 and users in ACE server(SecurID) ?? Some will say : easy !! use dbexport and import to manage users with a script !!

Well, not exactly !! If you dbexport and then dbimport the user base, you'll see that the FWZ box is now checked... This bug is now under investigation at checkpoint and could be a known limitation for now...

Of course, I could be wrong :-)

Patrick Desnoyers
Patrick.Desnoyers@matrox.com

-----Original Message-----
From: owner-fw-1-mailinglist@lists.us.checkpoint.com
[mailto:owner-fw-1-mailinglist@lists.us.checkpoint.com]On Behalf Of
Lenny Sanchez
Sent: Monday, March 26, 2001 11:49 AM
To: 'fw-1-mailinglist@lists.us.checkpoint.com'
Subject: [FW1] SecurID

Hi guys,

     We are implementing securID in our infrastructure as a way for people
on the outside to connect remotely to our network.  Setting up a test
machine with AOL as it's ISP for testing purpose and was wondering if any
one has encountered any problems using this model.  Also, looking for any
feedback from anyone who installed securID and what problems they've
encountered.

Thanks

Lenny Sanchez
Systems Administrator
HealthGate Data Corp

lennys@healthgate.com

================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================