Troubleshooting Tip: FortiGate admin account with TACACS+ authentication and fallback to local password

Configure an admin user on the FortiGate. Set the type to 'Match a user on the remote server group' as this option would allow setting the local password.

Visit this article: Technical Tip: How to configure TACACS+ authentication and authorization in FortiGate to complete the TACACS+ related config for authentication and authorization.

Admin account should be configured as below with the remote authentication and local backup password:

config system admin
    edit tacacs
        set remote-auth enable
        set accprofile prof_admin
        set vdom root
        set remote-group tacacs_admin
        set password ENC SH2Rh0YgEgb8KD6bOcUFz7S
        set accprofile-override enable
    next
end

Debug logs would show successful authentication when the TACACS+ server is up and running:

[579] fnbamd_tac_plus_validate_author_reply-arg cnt 3
[680] __tac_plus_rxtx-Result validating TAC+ rsp: 0
[116] __tac_plus_next_state-State: 'Author' -> 'Done'
[1032] fnbamd_tac_plus_result-
[624] fnbamd_tac_plus_process-Result for TAC+ svr 'FAC_TAC' is 0
[589] __parse_author_reply_args-
[594] __parse_author_reply_args-arg cnt 3
[375] __set_admin_prof-Authorization admin profile 'super_admin'
[363] __add_group-Authorization group 'tacacs'
[1051] fnbamd_tac_plus_result-res=0
[627] fnbam_user_auth_group_match-req id: 71498490273793, server: FAC_TAC, local auth: 0, dn match: 0
[206] find_matched_usr_grps-Passed group matching

Authenticating via local credentials can be restricted via global settings when servers are UP:

config system global
    set admin-restrict-local { enable | disable} <----- Default is set to disable.
end

enable: Enable local admin authentication restriction.
disable: Disable local admin authentication restriction.

Admin users can fallback to the local password when TACACS+ servers are completely down; however, unlike radius, the remote username would not work here, and the locally configured username and password would have to be used (as per the test scenario in v7.4.x).

[517] __tac_plus_conn_timeout-Connction with FAC_TAC:10.5.24.70 timed out.
[823] __tac_plus_error-Ret 10, st = 0.
[94] fnbamd_tac_plus_get_next_authen_type-Next authen type pap
[846] __tac_plus_error-Conn failed.
[660] fnbamd_cfg_tac_plus_update_reachability-10.5.24.70, conn_fails

Logged in admin list:

krypton-kvm07 # get system info admin status
Index User name Login type From
Logged in users: 3
USERNAME TYPE FROM TIME
admin https 10.xx.xx.xx Fri Jan 24 01:59:08 2025
admin jsconsole 10.xx.xx.xx Fri Jan 24 02:04:13 2025
tacacs https 10.xx.xx.xx Fri Jan 24 03:27:26 2025  

Related article:

Technical Tip: Access using TACACS+ authentication with admin profile and group matching