User Manual Part 2

Setting Up Remote VPN Access for Users
650 Check Point Safe@Office User Guide
Setting Up Remote VPN Access for Users
If you are using your Safe@Office appliance as a SecuRemote Remote Access VPN
Server, as an internal VPN Server, or as an L2TP VPN Server, you can allow users to
access it remotely through their Remote Access VPN Clients (a Check Point SecureClient,
Check Point SecuRemote, an L2TP VPN Client, or another Embedded NGX appliance).
To set up remote VPN access for a user
1. Enable your VPN Server, using the procedure Setting Up Your Safe@Office
Appliance as a VPN Server on page 567.
2. Add or edit th
e user, using the procedure Adding and Editing Users on page
643.
You m
u
st select the VPN Remote Access option.
Using RADIUS Authentication
You can use Remote Authentication Dial-In User Service (RADIUS) to authenticate both
Safe@Office appliance users and Remote Access VPN Clients trying to connect to the
Safe@Office appliance.
Note: When RADIUS authentication is in use, Remote Access VPN Clients must
have a certificate.
When a user tries to log in to the Safe@Office Portal, the Safe@Office appliance sends the
entered user name and password to the RADIUS server. The server then checks whether
the RADIUS database contains a matching user name and password pair. If so, then the
user is logged in.
By default, all RADIUS-authenticated users are assigned the set of permissions specified
in the Safe@Office Portal's RADIUS page. However, you can configure the RADIUS server
to pass the Safe@Office appliance a specific set of permissions to grant the authenticated
user, instead of these default permissions. This is done by configuring the RADIUS