> Source: [sk184957](https://support.checkpoint.com/results/sk/sk184957)

# sk184957 - Gaia API run-script fails for external AAA users after the first Ansible task on a VSX Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk184957 |
| Date Created | 2026-05-16 |
| Last Modified | 2026-05-19 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20 |
| OS | Gaia |
| Platform | Open Server |

## Symptoms

- * When you run an Ansible Playbook that uses the module `check_point.gaia.cp_gaia_run_script` with a non-local Authentication, Authorization, and Accounting (AAA) user like RADIUS or TACACS+, the following behavior occurs on a Virtual System Extension (VSX) Gateway:

  * The first task that runs a `clish -c` command through the Gaia API run-script endpoint succeeds.
  * Subsequent run-script tasks in the same Ansible Playbook fail.

  The failed tasks return this error:
  ````
  ```text````  
  ````
  CLINFR0220 User is not allowed to access any virtual-system.````  
  ````
  ```
  ````
* This issue occurs when all of the following conditions are met:

  * The Gateway is a VSX Gateway.
  * An external AAA user (RADIUS or TACACS+) performs the authentication.
  * The AAA user's default shell is clish.
  * The Ansible Playbook runs multiple consecutive run-script tasks.

  The same Ansible Playbook works correctly when you authenticate with a local Gaia administrator user. In that scenario, all consecutive run-script tasks succeed and return the expected output (for example, `show hostname` and `show date`).

## Cause

When an external AAA user (RADIUS or TACACS+) logs in to a VSX Gateway, Gaia creates temporary authorization data for that session. This data includes:

* The user's roles and permissions
* The list of Virtual Systems (VSs) the user can access

On VSX Gateways, access permissions are evaluated per VS.

The Clish shell relies on this temporary authorization data to verify that the user is allowed to access the requested VS.  

In Gaia API version 1.9 build 83 and lower, the Gaia API execution context does not retain the external AAA authorization context across consecutive run-script executions.

As a result:

1. The first run-script task succeeds.
2. When the second run-script task starts, Gaia API creates a new execution context.
3. The required temporary authorization data for the external AAA user is no longer available.
4. Clish denies access and returns the error from Symptom # 1.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content