2.5.4 Ensure Radius or TACACS+ server is configured - tacacs-servers state on

Information

Configured the TACACS-Servers or Radius server for central authentication.

Rationale:

Authentication, authorization and accounting (AAA) scheme provide an authoritative source for managing and monitoring access for devices.

Solution

run the following command to enable and add TACACS+ servers.
CLI:

Hostname> set aaa tacacs-servers state on
Hostname> add aaa tacacs-servers priority <priority_value> server <IP_Address> key <Key> timeout <timeout_value>

GUI:

Navigate to User Management > Authentication Servers > TACACS+ configuration > Ensuere Enable TACACS+ authentication is checked

Navigate to User Management > Authentication Servers > TACACS+ configuration > Enable TACACS+ Servers > Add Provide <Server_IP_Address>, <Priority> and <Timeout>.

Run the following command to enable and add Radius servers.
CLI:

Hostname>add aaa radius-servers priority <priority_value> host <IP_Address> secret <Key> port <Port_number> timeout <timeout_value>

GUI:

Navigate to User Management > Authentication Servers > Radius Servers > Add
Provide <Server_IP_Address>, <Priority>, <UDP_Port> and <Timeout>.

Default Value:

Not Configured

See Also

https://workbench.cisecurity.org/files/2828

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2

Plugin: CheckPoint

Control ID: 4d27628d31d879ca3a40df4d969989100e31dd3cf993972cf97214c66004e518