TACACS+ with Check Point Gaia & Cisco ISE — AuthZ Profile Created but Still Getting Denied

[Fatalis]

Hello everyone,

I’ve been working on integrating our Check Point firewalls (Gaia R81.x) with Cisco ISE for TACACS+ device administration and hit a roadblock that I can’t seem to get past. Hoping someone in the community has run into this and can point me in the right direction. 

Full disclosure a different team handles Cisco ISE and I do not have access to look in there myself and can only go off screenshots shared to me. [I have configured this in two separate environments with the same Gaia Clish configurations. The only thing that is different is the TACACS+ servers, Cisco ISE, and user credentials.]

Commands used

add aaa tacacs-servers priority 1 server <TACACS_SERVER_1> key ******** timeout 10
add aaa tacacs-servers priority 2 server <TACACS_SERVER_2> key ******** timeout 10
set aaa tacacs-servers state on
set aaa tacacs-servers user-uid 0
add rba role TACP-0 domain-type System readwrite-features tacacs_enable
add rba role TACP-15 domain-type System all-features
add user <AD_Username> uid 0 homedir /home/<AD_Username>
add rba user <AD_Username> roles TACP-15
set user <AD_Username> gid 100 shell /bin/bash
set user <AD_Username> realname "<AD_Username>"

 What works so far

Connectivity is good:

ping, nc -vz <ISE> 49, and tcpdump all confirm the firewall can reach ISE on TCP/49.
IP routes are correct, and ISE is receiving the authentication requests.
Authentication is successful:
ISE Live Logs show Passed-Authentication: Authentication succeeded.
Username is correctly resolved in Active Directory.
Authorization Profile was created:
In ISE, a created a Shell Profile (Checkpoint_Admin) with no custom attributes (mirrors separate working environment)
The TACACS+ policy matches the correct AD group and returns the profile

The Problem

On Gaia, I still get “Permission denied” when attempting SSH login with TACACS credentials.
Gaia logs show:
PAM-tacplus[…] auth failed: 2 tac_connect: all possible TACACS+ servers failed
In ISE Live Logs, AuthZ shows as 0 (no usable profile) even though the rule hits and the profile is applied.

What's been verified

Verified the shared secret matches on both sides.
Created a new test key just in case — same result.
Verified that show aaa tacacs-servers shows the ISE nodes as up.
Confirmed that the RBA role TACP-15 exists and has “All system features.”

Even with the Shell Profile in place, ISE shows AuthZ profile applied but Gaia still refuses login with “permission denied.”

Is there anything specific in CheckPoint RBA mappings that I might be missing?

Do ISE Shell Profiles need any attribute other than shell:priv-lvl=15 for Check Point (unlike IOS/NX-OS which only need that one)?

Could this be related to how Gaia interprets the AD group membership via TACACS?

Any advice or pointers would be hugely appreciated.

Thanks in advance!

[the_rock]

Right, but then it besg the question WHY does it not allow it?

Andy

[genisis__]

Exactly - now I have also just tried this:

add rba role TACP-15 domain-type System readwrite-features tacacs_enable
add rba role TACP-15 virtual-system-access all

with the same result.

[the_rock]

Did you end up opening TAC case?

[genisis__]

yes - will being doing more troubleshooting with TAC over a zoom this week.

[the_rock]

Hope it goes well and is useful.

Andy

[PhoneBoy]

Unfortunately, due to the way legacy VSX is implemented, VS-level separation at the OS level isn't really possible.
VSnext in R82 should support this.

[Chris_Atkinson]

Are you referring to something different than this:

add rba role <Existing Role Name>
virtual-system-access 0
virtual-system-access all
virtual-system-access VSID1,VSID2,...,VSIDn

See also: https://community.checkpoint.com/t5/Management/Read-Only-Access-to-Virtual-System/td-p/22842  

[genisis__]

Almost the same Chris - I also had a TAC session where we tried different things.  I believe an internal ticket has been raised as well.

Also the SK related to getting this working with Cisco ACS really needs updating to do this with Cisco ISE.  The TAC engineer to be fair could not assist on this side so it was a bit of a grey area, that said I don't think the issue is here.