ISE Device Admin with Checkpoint Firewalls.

[Anthony O'Reilly]

Hello,

I have a request from a customer who have a two node Cisco ISE deployment.

They are currently using it for Wired and Wireless NAC with Device Admin for the branch switches.

They have requested that they would like to add their ASAs and Checkpoint firewalls to the Device Admin on ISE via their AD. AD is already integrated with ISE.

For the ASA, I don't see an issue, ISE will be able to Authenticate and Authorize users logging in. The ASA will be able to do TACACS+ AuthC and AuthZ via ISE.

For the Checkpoint, this is the grey area for me.

For the Gaia OS (CLI) they can use TACP role? ISE can return a TACACS AuthC for the user login and using RBAC on the Chckpoint, ISE can return TACACS+ custom AuthZ attributes which Gaia accepts. 

What about the SmartConsole, this is the GUI. Am I right in saying that the GUI used Server Roles and not RBAC like Gaia?? Therefore ISE will only be able to to AuthC the user logging into the SmartConsole.

They want to add 20 of these devices to the Device Administration. Does this mean extra licensing?

Thanks

Anthony.

[balaji.bandi]

smart console / manage and settings add Servers / TACACS or Radius .

You need to look at the checkpoint guide on how you can guide as below :

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm

[Anthony O'Reilly]

Thanks @balaji.bandi for this but this doesn't stipulate between Gaia and SmartConsole. I want to get clarification that TACACS+ via ISE can do AuthC and AuthZ for Checkpoint GUI and CLI.

[balaji.bandi]

Just to be clear, we are discussing device administration rights.

Smart Console and GUI of GAIA work, never tested CLI, since CLI only allowed access to admin, until there is a requirement for access to CLI (since cli have powerful shell access on Check Point View) - i would avoid that until there is a requirement needed.

It should be possible to check on the checkpoint guides.

[ahollifield]

Why not use SAML for the GUI?

SAML everywhere you can. RADIUS/TACACS+ only where you must.