LINICKX.com

Checkpoint, Gaia, TACACS - two lines of config

nick — Tue, 11 Dec 2012 09:35:00 +0000

If you have a checkpoint firewall, you probably know about Gaia... and if you have more than one firewall admin, you probably want to individually authenticate them to the operating system (as apposed to a encrypted file of usernames & passwords which get's passed around the office)

 add rba role TACP-0 domain-type System all-features
 set aaa tacacs-servers authentication server 10.10.10.10 key mysecretkey

What you need to know about the above...

If a user can successfully authenticate by TACACS they become a super user, if you need different roles read up on "role based administration", TACP-15 and the enable_tacacs command.
The config has been tested on Cisco ACS 5.4, the default TACACS "default device administration" profile works with no changes.
This is tacacs authentication only, authorization is handled by the local RBA.

CheckPoint: "Encryption Failure: according to the policy the packet should not have been decrypted."

nick — Mon, 19 Nov 2012 15:59:00 +0000

The checkpoint sk article isn't that helpful... what it should say is... If you have your encryption domain set as "defined by topology", then check your topology!

Check Point CCSE R70

Nick Bettison — Wed, 09 Mar 2011 01:01:00 +0000

Checkpoint Nokia, How to enable SSH thru the default filter.

nick — Fri, 04 Sep 2009 09:56:00 +0100

I had lost this bookmark, saved here so I don't loose it again :)

Solution Title: How do I control / change access using defaultfilter and initialpolicy?

Solution ID: sk41117

There are various options given in the article, this...

ipso[nick]# cp -p $FWDIR/conf/initial_module.pf $FWDIR/conf/initial_module.pf.OLD
ipso[nick]# cp $FWDIR/lib/defaultfilter.ipso $FWDIR/conf/initial_module.pf
ipso[nick]# comp_init_policy -g
initial_module:
Compiled OK.
ipso[nick]#

... will do in most cases!

Check Point CCSE

Nick Bettison — Tue, 02 Jul 2002 03:03:00 +0100

Check Point CCSA

Nick Bettison — Tue, 02 Jul 2002 02:03:00 +0100

Check Point CCSA 2000

Nick Bettison — Mon, 09 Jul 2001 01:01:00 +0100

Check Point CCSE 2000

Nick Bettison — Mon, 09 Jul 2001 01:01:00 +0100