Managing Authentication Servers

On the Users & Objects view > User Management section > Authentication Servers page you can define and view different authentication servers where users can define both an external user database and the authentication method for users in that database.

You can configure these types of authentication:

• RADIUS server - Define the details of a primary and secondary RADIUS server. The Spark Firewall Appliance can connect to these servers and recognize users defined in them and authenticated by them.

• TACACS+ server - TACACS+ is an access control mechanism that enables user authentication and authorization of users by a separate server on the network.

Configuring RADIUS Servers

To add a RADIUS server](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Authentication Servers page.

2. In the section RADIUS Servers, click Configure.

3. In the Primary tab, enter this information:

• IP address - The IP address of the RADIUS server.

• Port - The port number through which the RADIUS server communicates with clients. The default is 1812.

• Shared secret - The secret (pre-shared information used for message "encryption") between the RADIUS server and the Spark Firewall Appliance.

Select Show to see the shared secret.

| | | | --- | --- | | | Note - You cannot use these characters in a password or shared secret: { } [ ] ` ~ | ‘ " \ (maximum number of characters: 255) |

• Timeout (seconds) - A timeout value in seconds for communication with the RADIUS server. The timeout default is 3 seconds.

4. On the Secondary tab, repeat Step 2 for a Secondary RADIUS server if applicable.

5. Click Apply

The primary and secondary servers (if defined) are added to the RADIUS section on the page.

To edit a RADIUS server](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Authentication Servers page.

2. Click the IP address link of the RADIUS server you want to edit.

3. Make the necessary changes.

4. Click Apply

To delete a RADIUS server](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Authentication Servers page.

2. Next to the RADIUS server you want to delete, click the Remove link.

To configure a RADIUS server administrator](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Administrators page.

2. In the line Administrator RADIUS authentication is, click Edit permissions.

3. Select Enable RADIUS authentication for administrators.

4. Select one of these:

   • Use roles defined on RADIUS server

• Use default role for RADIUS users
  1. In the Default Administrators Role, select the applicable role.

2. Optional: Select For Administrators use specific RADIUS group only.

Enter the applicable RADIUS groups. 5. Click Apply

To configure remote access permissions for users defined on the RADIUS server](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Administrators page.

2. Click the link in the sentence Remote access permissions for RADIUS users are disabled.

3. Select Enable RADIUS authentication for User Awareness, Remote Access and Hotspot.

4. Optional: Select For Remote Access use specific RADIUS groups only.

Enter the applicable RADIUS groups.

5. Click Apply

6. Configure the remote access permissions for RADIUS users in the VPN view > Remote Access section > Remote Access Users page.

Configuring TACACS+ Servers

To add a TACACS+ server](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Authentication Servers page.

2. In the section TACACS+ Servers, click Configure.

3. In the Primary tab, enter this information:

• IP address - The IP address of the TACACS+ server.

• Port - The port number through which the TACACS+ server communicates with clients. The default is 49.

• Shared secret - The secret (pre-shared information used for message "encryption") between the TACACS+ server and the Spark Firewall Appliance.

Select Show to see the shared secret.

| | | | --- | --- | | | Note - You cannot use these characters in a password or shared secret: { } [ ] ` ~ | ‘ " \ (maximum number of characters: 255) |

• Timeout (seconds) - A timeout value in seconds for communication with the TACACS+ server. The timeout default is 3 seconds.

4. On the Secondary tab, repeat Step 2 for a Secondary TACACS+ server if applicable.

5. Click Apply

To delete a TACACS+ server](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Authentication Servers page.

2. Next to the TACACS+ server you want to delete, click the Remove link.

To configure a TACACS+ server administrator](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Managing-Authentication-Servers.htm?TocPath=Managing%20Users%20and%20Objects%7C_____3#)

1. Click the Users & Objects view > Users Management section > Administrators page.

2. In the line Administrator TACACS+ authentication is, click Edit permissions.

3. Select Enable TACACS+ authentication for administrators.

4. Select one of these:

   • Use roles defined on TACACS+ server

• Use default role for TACACS+ users

In the Default Administrators Role, select the applicable role. 5. Click Apply

30 April 2026