Visitor III

Solved

configuring tacacs in multi-vdom firewall

Forum|Forum|10 months ago
November 11, 2025
9 replies
1396 views

Hi,

our firewall is in version 7.6 and we have multi-vdom. I notice that from the vdoms, I can configure tacacs: #config user tacacs+, however when I'm in global, I don't have this command.

is that a way to configure it under Global (#config global #config user tacacs+ ) rather than going to individual vdom and do it (#config vdom #edit x #config user tacacs)?

Also if I have a ha cluster (active-passive), I suppose I don't need to config anything on passive devices, as the config getting synchronised through all the firewalls?

Thanks

FortiGate

Best answer by Toshi_Esumi

Yes. That's what we do for mutil-vdom(customers) environment with TACACS authentication for those admin users, who manage all vdom(customers) config.
Although the TACACS config is in management (in your case "root") vdom, the admin configuration is still under "config global" -> "config sys admin". Then you can refer to the TACACS server or a group of servers you definded in management (root) vdom.

The management vdom works as kind of a central vdom, which communicate with FortiGard and some others, which doesn't specifically belong to any other vdoms. As you realized, "global" doesn't have any capability to communicate with outside of the box. So the management vdom does that and that's why the management vdom needs to have a connectivity to the internet.

Toshi

AEK

SuperUser

Hi

User config is per VDOM. It is not configurable in global.

Yes in active passive HA all configuration is synchronized automatically, including user configuration.

AEK

DaryayaAuthor

Visitor III

thanks, so I have to replicate users in every vdom, rather than adding them in global and define which vdoms they can have access?

AEK

SuperUser

Yes that's right. You replicate users in every VDOM.

With VDOMs it is just like if you have multiple firewalls. So each firewall has its own config.

AEK

grotesque

Explorer

Hey there.

You mean to configure for administrator users?

Thanks.

DaryayaAuthor

Visitor III

configure tacacs, so use tacacs to authenticate users rather than adding local users.

Toshi_Esumi

SuperUser

Are those "users" are like VDOM specific VPN users or admin users to mage one VDOM (vdom admin)? If global admin users instead, those need to be defined or remote authenticated (like via TACACS) from a management VDOM (by default "root").

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO