topic Fine tuning on tacacs+ authentication in Firewall and Security Management

Fine tuning on tacacs+ authentication

cassiomaciel — Mon, 06 Nov 2023 14:48:35 GMT

Hi CheckMates,

I've configured tacacs+ on my gateways and it's working properly.

However, when the user type a bad password, the account is locked instantly on AD.

The gateway is retrying the same authentication with bad credentials, until the user got blocked.

I would like to know, if is there any fine tuning on tacacs configuration in the gateways to avoid this problem.

I'm using 2 tacacs servers with 60s of timeout.

Re: Fine tuning on tacacs+ authentication

PhoneBoy — Mon, 06 Nov 2023 23:12:50 GMT

What version/JHF?
What functionality is TACACS+ configured to provide authentication for?

Re: Fine tuning on tacacs+ authentication

cassiomaciel — Tue, 07 Nov 2023 19:25:53 GMT

Hi,

All gateways are in R81.10 with JHF 95 or JHF 110, also I've a mix of maestro and traditional clusters.

We're using TACACS+ to authenticate users by console via ssh and gaia via https.

We configured the roles TACP-0 with a few features in read-only and some custom commands and TACP-15 with all features in read-write.

On my TACACS+ server, I noticed 2 attempts in a row, coming from the gateway with a difference of 6s or less, the gateway is trying to authenticate on both servers, that result in 4 failed authentications.

Our password policy on AD, block the user with 3 failed attemtps.

is it expected to gateway try authenticate the user twice? Is there any configuration that I can do or is better to open a case with TAC?

Re: Fine tuning on tacacs+ authentication

PhoneBoy — Tue, 07 Nov 2023 20:36:21 GMT

Not sure if it should be trying to authenticate on both TACACS+ servers.
A TAC case is probably warranted here: https://help.checkpoint.com