fortigate Tacacs+

Forum|Forum|2 years ago
July 17, 2023
2 replies
2629 views

Hi,

wonder anyone had encountered this before? I had checked everywhere for solutions or help, but not much information.

Fortigate firmware is 7.0.6

We had configured the Tacacs+ in fgt but could not communicate with the Tacacs+ server.

We follow the guide, FGT 7.0.6 > Administration Guide > TACACS+ servers.

Best answer by kvimaladevi

Hi StevenT,

If you are still facing issues, please check if the traffic is sent from the Fortigate and if there is a drop from the firewall or from the server.

diag sniffer packet any 'port 49' 4 0 a

you can stop the debug using the command ctrl+c

putty 2:

#diagnose debug reset

#diagnose debug flow filter daddr x.x.x.x <--- IP address of the tacacs server
##diagnose debug flow show function-name enable

#diagnose debug flow trace start 1000
ping the tacacs server
#diagnose debug enable

You can stop the debug using the command di de di

Please check the tracert from the firewall cli to check until which hop the traffic reaches.

Regards,

Vimala

ebilcari

Staff

Did you configure FGT as a client in the TACACS server? Be aware that since FGT have many IPs it will choose the IP of the interface it uses to reach the server. The TACACS server will drop the requests if it's not sourced by the one that is specified as the client IP.
You can change the configured IP on the server or manually set up a source IP in FGT via CLI:

config user tacacs+
   edit "TAC"
      set source-ip x.x.x.x

Emirjon

kvimaladeviAnswer