Technical Tip: TACACS behavior difference when 'ha-direct' is enabled or disabled

Description

This article describes how the behavior of a TACACS+ packet on a FortiGate HA cluster differs depending on the ha-direct option.

Scope

FortiGate HA clusters.

Solution

The following TACACS+ server is configured.

config user tacacs+
    edit "tacacs-lab"
        set server "10.122.2.141"
        set key ENC xxxx
        set authorization enable
    next
end

Scenario 1: ha-direct enabled.

When 'ha-direct is enabled, each FortiGate unit will initiate the TACACS connection from the ha-reserved management interface.

config system ha
    set mode a-p
    set ha-mgmt-status enable
        config ha-mgmt-interfaces
            edit 1
                set interface "port10"
                set gateway 10.47.47.254
            next
        end
    set ha-direct enable
end

These are the packet capture outputs when both units are initiating TACACS+ communication.

On the primary FortiGate:

FGLAB-Primary # diagnose sniffer packet any "port 49" 4
69.296772 port10 out 10.47.36.167.9254 -> 10.122.2.141.49: syn 1358058984

On the secondary FortiGate:

FGLAB-Secondary # diagnose sniffer packet any "port 49" 4
54.060202 port10 out 10.47.33.99.1526 -> 10.122.2.141.49: syn 1635869956

Scenario 2: ha-direct disabled. 

When 'ha-direct is disabled, the secondary unit will not have any routing capabilities, and the primary firewall will use the FIB table to determine the outgoing interface.

config system ha
    set mode a-p
    set ha-mgmt-status enable
        config ha-mgmt-interfaces
            edit 1
                set interface "port10"
                set gateway 10.47.47.254
            next
        end
    end

 
Routing table output:

FGLAB-Primary# get router info routing-table details 10.122.2.141

Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 10, metric 0, best
* vrf 0 10.47.15.254, via port1

These are the packet capture outputs when both units are initiating TACACS+ communication.

Primary:

Packet capture output:

FGLAB-Primary # diagnose sniffer packet any "port 49" 4
13.072466 port1 out 10.47.4.167.7026 -> 10.122.2.141.49: syn 532792360

Secondary: The packet capture is empty, as expected.

FGLAB-Secondary # diagnose sniffer packet any "port 49" 4

Related article:

Troubleshooting Tip: TACACS requests going through the HA management interface