Configuring TACACS+ Servers

Configuring TACACS+ Servers in Gaia Portal

Note - You must connect to the Gaia Portal Web interface for the Check Point Gaia operating system. of the applicable Security Group A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected..

To configure a TACACS+ server

Step	Instructions
1	In the navigation tree, click User Management > Authentication Servers.
2	In the TACACS+ Configuration section, select Enable TACACS+ authentication. This setting applies to all configured TACACS+ servers.
3	Click Apply.
4	In the TACACS+ Servers section, click Add.
5	Configure the TACACS+ parameters: Priority The priority of the TACACS+ server - from 1 to 20. Must be unique for this operating system. Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. uses the priority: To determine the order, in which Gaia connects to the TACACS+ servers. First, Gaia connects to the TACACS+ server with the lowest priority number. For example: Three TACACS+ servers have a priority of 1, 5, and 10 respectively. Gaia connects to these TACACS+ servers in that order, and uses the first TACACS+ server that responds. To identify the TACACS+ server in commands. A command with `priority 1` applies to the TACACS+ server with priority 1. Server IPv4 address of the TACACS+ server. Shared Key The Shared Secret used for authentication between the TACACS+ server and Gaia. Enter the shared secret text string up to 256 characters, without any whitespace characters and without a backslash. Make sure that the shared string defined on the Gaia matches the shared string defined on the TACACS+ server. Timeout in Seconds Enter the timeout in seconds (from 1 to 60), during which Gaia waits for the TACACS+ server to respond. The default value is 5. If there is no response after the configured timeout, Gaia tries to connect to a different configured TACACS+ server.
6	Click OK.
7	Optional: In the TACACS+ Servers Advanced Configuration section, select the User UID - 0, or 96 and click Apply. This setting applies to all configured TACACS+ servers.

To disable TACACS+ authentication

Step

Instructions

In the navigation tree, click User Management > Authentication Servers.

In the TACACS+ configuration section, clear Enable TACACS+ authentication.

This setting applies to all configured TACACS+ servers.

Click Apply.

To delete a TACACS+ server

Step	Instructions
1	In the navigation tree, click User Management > Authentication Servers.
2	In the TACACS+ Servers section, select a TACACS+ server.
3	Click Delete.
4	Click OK to confirm.

Configuring TACACS+ Servers in Gaia Clish

Note - You must connect to the Gaia Portal of the applicable Security Group.

Syntax

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently.

Parameters

CLI Parameters

Parameter	Description
`priority <Priority>`	The priority of the TACACS+ server - from 1 to 20. Must be unique for this operating system. The priority is used: To determine the order, in which Gaia connects to the TACACS+ servers. First, Gaia connects to the TACACS+ server with the lowest priority number. For example: Three TACACS+ servers have a priority of 1, 5, and 10 respectively. Gaia connects to these TACACS+ servers in that order, and uses the first TACACS+ server that responds. To identify the TACACS+ server in commands. A command with `priority 1` applies to the TACACS+ server with priority 1. Values: Range: 1 - 20 Default: No default
`server <IPv4 Address of TACACS+ Server>`	IPv4 address of the TACACS+ server.
`key <Shared Secret>`	The Shared Secret used for authentication between the TACACS+ server and Gaia. Enter the shared secret text string up to 256 characters, without any whitespace characters and without a backslash. Make sure that the shared string defined on the Gaia matches the shared string defined on the TACACS+ server.
`timeout <1-60>`	Enter the timeout in seconds, during which Gaia waits for the TACACS+ server to respond. If there is no response after the configured timeout, Gaia tries to connect to a different configured TACACS+ server. Range: 1 - 60 Default: 5
`new-priority <New Priority>`	Configures the new priority for the TACACS+ server.
`state {on \| off}`	Configures the state of TACACS+ authentication. Range: `on`, or `off` Default: `off`

Checking if the Logged In User is Enabled for TACACS+

Procedure

Step

Instructions

Connect to the command line on Gaia.

Log in to Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

Go to Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group.: enter gclish and press Enter.

Run:

show tacacs_enable