Technical Tip: FortiAuthenticator Tacacs+ troubleshooting and debugs

This article describes how to get debugs for Tacacs+ authentication on FortiAuthenticator appliance.

FortiAuthenticator.

In the FortiAuthenticator Tacacs debugs, the configured realm is not shown instead it refers to readiusRealm.

This causes confusion whether the realm configuration has been honoured during an authentication request.

The above screenshot shows realmtest as the configured realm on the Tacacs Policy.

 In the Tacacs debugs however, the realm is shown as radiusRealm.

This result may cause some concern whether the correct real has been matched by FortiAuthenticator’s Tacacs Policy.

The realm can be verified if explicitly mentioned in the user login using the Tacacs Authentication debugs along with authentication method.

In order to get more details, use the Radius Authentication debug in the debugs section.

In the above debugs it shows that a realm was not specified and realm ID: 1 is used as default.