External commands are commands added to Gaia Clish with the 'add command' command.

External users that are authenticated by RADIUS are not able to run external commands in Gaia Clish.

Title: RADIUS-authenticated users are not able to run external commands in Gaia Clish

sk32612 (Authentication is not working on SecurePlatform with RADIUS groups).

Then, change the :radius_groups_attr (18) property. If this does not work, use a different attribute.įor example, for Reply-Message has an attribute number 18.

The attribute value should be the RADIUS group name.

On the RADIUS Server, modify the RADIUS group to include a 'Class' attribute. Refer to Gaia Administration Guide for your version. If a group is defined on RADIUS server for the client (group XXX, for example), then define the role: radius-group-XXX.If no group is defined on the RADIUS server for the client, then define the role: radius-group-any.Configure the role for the RADIUS client: vpn debug on vpn debug ikeon vpn debug trunc (empties the file, adds a stamp line & enables both VPN and IKE debugging) vpn tu Select the option to delete IPSEC+IKE SAs for a.(The RADIUS 'Class' attribute holds the group name).Īfter the RADIUS group is retrieved, the RADIUS client maps the RADIUS group to the appropriate RADIUS client group. When this group is present in the group list of the Gaia machine, ALL users defined on the RADIUS server are able to log in to the Gaia machine.Īfter users and groups are configured in RADIUS, the RADIUS client handles authentication and examines the specified RADIUS class to retrieve the user's groups. There is a special RADIUS group called 'any'. 'Class' attribute is not set, or it is not tied to the Group on the RADIUS server.

Checkpoint vpn debug commands