This document serves as a detailed guide for how to configure the integration between Check Point GAIA systems and Cisco Identity Services Engine (ISE) for TACACS authentication/authorization.
Administrative
Assumptions and recommendations
The goal is to:
- Authenticate and authorize AD users logging into GAIA systems via a TACACS+ server
- Configure various roles in Check Point GAIA systems via Role-based Access, with various commands/functionality available to each role
- Control which roles users get assigned to, based on their AD group membership. Specifically, map each AD security group to a particular GAIA role.
- Prevent users in a lower-privilege role from elevating their privileges to a higher role than they are permitted (controlled by their AD group membership).
- The Check Point devices being integrated are running GAIA R80 or higher
- The customer is using Cisco ISE 3.2.x
- The authentication protocol between the GAIA system and the Cisco ISE server is: TACACS+
- The TACACS+ server (Cisco ISE), should relay authentication requests to the Windows Domain Controller/s
- The Domain Controllers have at least two user security groups. Each security group is mapped to a particular GAIA role.
- The permissions for the GAIA roles are defined in such a way that any role with privilege level X (0-15), will have at least equal or lower privileges than all the privilege levels below it. For example, a user with privilege level 9, will have authorization to perform any functions/commands defined in any privilege level from 0-9. That user will not, however, be able to elevate their privilege level above 9. If they attempt to elevate to privilege level 10-15, they will be denied access.
Technical
Reference Documents
- sk98733 - Best Practices - Configuring Cisco ACS 5 server for TACACS+ authentication with Gaia OS
- sk101573 - How to configure Gaia OS to work with a TACACS+ server
- Cisco Identity Services Engine Administrator Guide, Release 3.2
TACACS:
TACACS (Terminal Access Controller Access Control System) is a security protocol that centrally validates users attempting to access a network device. TACACS+ provides separate authentication, authorization and accounting services.
A shell profile is a basic permissions container for TACACS+-based access. You can specify which TACACS+ attributes and attribute values should be returned to the TACACS+ client, in addition to the Cisco IOS privilege level, session timeout, and other parameters.
Cisco ISE:
Cisco ISE supports device administration using the TACACS+ security protocol to control and audit network device configuration. The network devices are configured to query Cisco ISE for authentication and authorization of device administrator actions.
It enables granular control over who can access which network device and change its associated settings. A Cisco ISE administrator can create policy sets that allow TACACS results, such as command sets and shell profiles, to be selected in authorization policy rules in a device administration access service.
The Cisco ISE administrator uses the device administration features (in the Cisco ISE GUI) to control and audit the configuration of the network devices. A device can be configured to query the Cisco ISE server using the TACACS security protocol.
A Cisco ISE administrator can perform the following tasks:
- Configure network devices with the TACACS+ details (shared secret).
- Add device administrators as internal users and set their enable passwords as needed.
- Create policy sets that allow TACACS results, such as command sets and shell profiles, to be selected in authorization policy rules in a device administration access service.
- Configure the TACACS server in Cisco ISE to allow device administrators to access devices based on the policy sets.
When a device administrator logs on to a device, the device queries the Cisco ISE server, which in turn queries an internal or external identity store, to validate the device administrator's details.
Check Point:
To log in to Gaia OS using TACACS+, configure the role TACP-0 and, for each privileged level "X" used with tacacs_enable, configure it.
To elevate privilege levels in GAIA and move between GAIA roles, you will need to configure the enable password on the TACACS server. The enable password is valid for elevating to all privileged levels up to the maximum level that the user is permitted. The enable password can either be the same as the user’s or a different custom password. The TACACS Administrator controls this.
Authorization to the various GAIA roles is controlled on the TACACS server via the shell profile configured for a particular user or group.
Once logged into a GAIA system via TACACS, all users will be granted authorization to execute the commands defined in the GAIA role: TACP-0 (minimum privileges). In order to elevate your privileges to a higher level, use the GAIA clish command:
tacacs_enable TACP-X (1-15)
For GAIA GUI:
After logging in, you can use the TACACS+ Enable button in the Gaia Portal to gain elevated privileges.
