> Source: [sk127172](https://support.checkpoint.com/results/sk/sk127172)

# sk127172 - After upgrading from R77.20.60 on Gaia Embedded, RADIUS authentication stops working

| Property | Value |
|----------|-------|
| Solution ID | sk127172 |
| Date Created | 2018-05-26 |
| Last Modified | 2022-07-14 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R82.00.X, R81.10.X |
| Platform | VMWare ESX |

## Symptoms

- * After upgrading from R77.20.60 to any newer version, RADIUS authentication stops working.
* Radius authentication is not working Authentication is working, if we set "Use default role for RADIUS users". But it's not working, if we set "Use roles defined on RADIUS server".

## Cause

Starting from R77.20.70, the new default setting for RADIUS authenticaiton has changed from "*Use default role for RADIUS users* " to "*Use roles defined on RADIUS Server*".

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk127172/RADIUSRolls1805161053.PNG)

## Solution

To resolve the problem, configure the RADIUS server to map a user group to the role.

To map user group from RADIUS:

1. Go to 'Policies' tab.  

2. Select the 'Network Policies' tab.   

3. Right click on 'Network Policies' and select 'New'  

4. Enter a Policy name like "Check Point Radius Access" and click Next.  

5. Add a condition by clicking 'Add...'  

6. Select 'User Groups' and click 'Add Groups...' and add the group for Users you want authenticated and click Next.   

7. Access granted, click Next  

8. On the Configure Authentication Methods screen, unselect all the options and only select 'Unencrypted authentication (PAP, SPAP)', Next.  

9. Configure Constraits, keep default and click Next.   

10. Select 'Vendor Specific'. Click 'Add' and select 'Vendor-Specific'. Click 'Add' to enter a new attribute.  

11. Click Add and select 'Enter Vendor Code' and type '2620'.   
    Select 'Yes, it conforms'. Click 'Configure Attribute...'.

    ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1526490977314/111805161048.PNG)
12. In the Configure VSA (RFC Compliant) window, enter: Vendor-assigned attribute number: 229  
    Attribute formate: String  
    Attribute value: 'adminRole'

    ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1526490977314/121805161047.PNG)

    **Note:** for read and write role, use 'adminRole'. For read only, use 'monitorrole'.

To troubleshoot if it's still not working, run packet capture with on the Windows Server and filter for radius. You should see Access-Request and Access-Accept. Check in Event Viewer from the server and look for the authentication success or failure.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content