Explanation:
Client Authentication
Check Point VPN-1/FireWall-1 provides two other authentication methods, which provide authentication for any service. The first of these is client authentication, which provides authentication for any service by using out-of-band authentication, rather than in-band authentication (which is used for user authentication). With user authentication, all authentication is performed within the HTTP, FTP, TELNET, or RLOGIN connection on the client host-this means that authentication is performed in-band, as part of the application-layer protocol. With client authentication, a user on a client host must first of all establish a separate connection to the enforcement module and authenticate, after which the client can then establish a connection using the permitted services in the client authentication rule on the enforcement module. The authentication is totally separate from the actual application-layer protocols that the user is accessing, hence the term outofband. The out-of-band connections to the enforcement module can be established using either of the following mechanisms:
HTTP You can point your web browser to Port 900 on the enforcement module, which provides a connection to the HTTP security server for client authentication purposes. A special web page is presented, which allows you to specify your username and password, after which you can choose to gain access to all services permitted in the client authentication rule, or specific hosts and services on each.
TELNET You can establish a TELNET connection to Port 259 on the enforcement module, which provides a connection to the TELNET security server for client authentication purposes. You specify your username and password, after which you can choose to gain access to all services permitted in the client authentication rule, or specific hosts and services on each. Once a user has successfully authenticated, access to the hosts and services specified by the client authentication rule (or access to the hosts and services specified by the user during the authentication process) is provided. It is important to note that the IP address of the host is permitted, meaning that one or more users on the host can establish as many connections to permitted hosts and services as they like. For example, if a user called alice on a PC with an IP address of 192.168.1.10 performs client authentication successfully, another user could use Alice's PC and be permitted access through the enforcement module, even though the access is intended for alice. This is less secure than user authentication, where access is granted on a perconnection basis. With client authentication, although authentication is performed on a user basis, access is actually granted on a per-IP address basic .

---