Check Point TACACS+

[vsurresh]

Hi, all. I'm looking to get some clarification regarding the TACACS+ implementation with Check Point.

I've been trying to get TACACS+ working (Cisco ISE) with Check Points for the last few days with no success.I read almost all the community posts and KB articles but none of them provide any clarification on how this actually works or may be I'm confused.

What I'm trying to acheive is,

1. If a user from a specific group (network-admins) logins to CP, he/she should get full admin access.
2. If a user from a specific group (IT-ops) logins to CP, he/she should get read-only access.

Can this be achieved by Check Point TACACS+?

I easily set this up for Palo Alto by using 'Custom TACACS+ attributes' where ISE sends custom attributes which matches the name of the 'Admin Role' configured on Palo Alto.

sk101573 shows that we need to create two roles 'TACP-0' and 'TACP-15' but how do we map this on the TACACS+ server? How does Check Point knows a particular user supposed to use TACP-0 or TACP-1. I tried to add this as the custom attributes on ISE but didn't work.

If I go under User Management > Authentication Servers there is an option to change the 'UID' What does that mean? The default is set to 96.
TACACS+ users will login with this UID.

Thanks in advance.

[G_W_Albrecht]

Did you already try sk98733 Best Practices - Configuring Cisco ACS 5 server for TACACS+ authentication with Gaia OS ?

[vsurresh]

Thanks for the response. Yes, I did add 'Priv level 15' but that didn't make a difference. After reading various posts, it looks like Check Point doesn't support custom attributes with TACACS+ so, there is no way for the Check Point to know which role to apply to a specific user. That leaves us with only another option which is Radius. The whole point of TACACS+ is authorization but it doesn't seem to work well with Check Point or I'm missing something. 

[G_W_Albrecht]

You can always get help from TAC if the are issues with the configuration.