topic Re: Tacacs+ on different port in Firewall and Security Management

Tacacs+ on different port

charlie — Fri, 09 Apr 2021 11:14:59 GMT

Hello,

I need to contact the Tacacs server from the Security Gateway on a custom port instead of the default port(49).
Standard step don't include the option to set the port. There is a way to change the port 49?

Regards,

Charlie

Re: Tacacs+ on different port

the_rock — Fri, 09 Apr 2021 11:11:40 GMT

Are you not able to create custom service and then assign a port to it?

Re: Tacacs+ on different port

charlie — Fri, 09 Apr 2021 11:19:44 GMT

The source it's the Firewall that have a tacacs configured, but for some reason we need to change the port from 49 to a new one.
From Firewall I can set priority, ip and the key, but I need to change the port.

Re: Tacacs+ on different port

the_rock — Fri, 09 Apr 2021 11:29:10 GMT

Would you mind share screenshot?

Re: Tacacs+ on different port

charlie — Fri, 09 Apr 2021 11:36:55 GMT

This is the Checkpoint Tacacs+ server configuration

I hope that there is a conf file where I can change the default port

Re: Tacacs+ on different port

the_rock — Fri, 09 Apr 2021 11:54:53 GMT

Ok, got it. Not sure if below link might help, but maybe someone else can chime in. I know you can change ssh port easily from /etc/ssh, but I dont see anything in /etc for tacacs, really sorry mate.

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk101573

Re: Tacacs+ on different port

Timothy_Hall — Fri, 09 Apr 2021 13:36:10 GMT

It appears the only way to do this is to hack the tacacs service definitions in the /etc/services file from expert mode; I just tried changing the TACACS port to 149, rebooted and it worked. The /etc/services file is not auto-generated upon Gaia system startup so your changes should stick.

However be sure to document this /etc/services file change as it is likely to get overwritten by a version upgrade or even possibly a Jumbo HFA installation. You'll need to manually check that your port change survived after either of these types of operations.

Re: Tacacs+ on different port

charlie — Fri, 09 Apr 2021 13:40:28 GMT

Thanks!!!

I'm going to discuss with the Team If we really need to perform this change or we can avoid

Regards

Re: Tacacs+ on different port

the_rock — Fri, 09 Apr 2021 14:16:04 GMT

Thanks Tim, thats good to know!!

Re: Tacacs+ on different port

KhevynLerroy — Thu, 23 Dec 2021 11:39:49 GMT

The easyest way to do that is configuring a destination NAT where you should tell the firewall every time the firewall IP try to reach the tacacs IP on port 49 change the destination port to xxxx. We did it on our environment and it works well.