Adding 3rd party firewall to ISE using RADIUS.

[JohnNetEng]

I'm having trouble adding a Checkpoint firewall to ISE 2.4. I've been following a blog where the author claims to have successfully added it to ISE 2.1, (here http://mdtnets.blogspot.com/2016/07/checkpoint-gaia-radius-authentication.html).

In the part where he gets to "Authentication Policy" I assume it's been replaced by Policy Sets. Running into trouble setting up the conditional "If DEVICE:Device Type Equals Device Type#All Device Types#Checkpoint"

I can do the"if DEVICE:Device Type Equals: All Device Types" but am not given an option for any other parameters. Am I missing something here?

[paul · Accepted solution]

You define your network device groups (NDGs) on the Administration->Network Resources->Network Device Groups screen.  Under the Device Type NDG you add a new entry called "Checkpoint".  Then you have to add the Checkpoints into ISE as Network Devices (Administration->Network Resources->Network Devices).  You assign them to the correct NDG Device Type, enter their name, IP and RADIUS shared secret.  Now you are setup.  

You can build a policy set whose admission criteria is Device Type = Checkpoint and build the rules you want.

[Cory Peterson · Accepted solution]

You need to add the device group yourself:

Then add the Device to the group:

[JohnNetEng]

Thanks a lot. This worked.