topic Re: TACACS Authentication in General Topics

TACACS Authentication

Malik1 — Mon, 02 Feb 2026 10:44:13 GMT

Hi Experts ,

We are currently integrating Check Point devices (firewalls, management servers, MHOs) with TACACS for administrator authentication.

Authentication via TACACS is successful, and we can see the success logs on the TACACS server. However, after login:

CLI access: User is authenticated but immediately logged out
GUI / SmartConsole: Error displayed – “You are not configured for Web access”

We have already followed the Check Point Admin Guide and:

Enabled TACACS authentication
Created the required roles on Check Point (TACP-0 and TACP-15) with appropriate permissions

What could be the issue ?

Regards

Sijeel

Re: TACACS Authentication

Vincent_Bacher — Mon, 02 Feb 2026 11:22:59 GMT

For me it looks like you are facing a successful authentication followed by a failed authorization.
Maybe it is a misconfiguration on your end but maybe not.
My idea:
The Check Point Gaia OS receives a "Password Correct" message from your TACACS server, but because the server doesn't send instructions on what the user is allowed to do, Gaia defaults to the most restrictive state (immediate logout for CLI and "not configured" for Web).

I guess Custom Attributes to be defined on TACACs server.
On the sk I know about TACACs i don't see anything about that but in our environment we do authorization via TACACs server, in our Case Cisco ISE and it's done like this:

Policy Elements::

Device Administration
- Tacacs+ Profiles
  - CheckPoint
    - 1. General tab
    - Name: CheckPoint
      
      Description: CheckPoint Firewall
    - 2. Custom Attibutes tab
    - Attribute/Requirement/Value:
      
      CheckPoint-SuperUser-Access=1
      
      Mandatory
      
      1
      
      Attribute/Requirement/Value:
      
      Checkpoint-User-Role=adminRole
      
      Mandatory
      
      adminRole

Re: TACACS Authentication

the_rock — Tue, 03 Feb 2026 02:35:13 GMT

What Vince said makes sense. See if below is configured:

✅ Most Likely Root Cause

Your TACACS server is not returning the required Check Point–specific TACACS attributes.

Check Point uses two role names that must be exact matches:

TACP-0 → Read‑only
TACP-15 → Superuser

If TACACS returns no role, or a role name mismatch, Check Point:

✔ Accepts authentication
✘ Fails authorization → session closed (CLI) / no web access (GUI)

Re: TACACS Authentication

the_rock — Sun, 08 Feb 2026 23:52:32 GMT

Hey Malik,

Were you able to figure this out?