Skip to main content
AaronChih
AaronChih
New Member
November 9, 2016
Question

[HELP] Authenticated TACACS+ first then local

  • November 9, 2016
  • 1 reply
  • 4316 views

Hi all,

If you can not understand what i'm saying,I apologize for my poor English.

 

I have a question in using TACACS+ . When TACACS+ server is active ,and my fortigate can reach the TACACS+ server.

Can I only let user login with tacacs+ account ,and failed when use local account?

And when fortigate can't reach TACACS+ server, user only can login with local account?

 

what should I configure to reach this goal?

I've study lot of web site but got no answer

 

My Fortigate is 1500D with version 5.0.14

1 reply

michaelbazy_FTNT
Staff
michaelbazy_FTNT
Staff
November 9, 2016

Hi Aaron,

 

I don't think that you can specify a detection for TACACS status.

 

Therefore, you can't.

 

However, what I'd do would be, in case of a local authentication, to add 2-factor auth to limit the risk.

 

Cheers,

AaronChih
AaronChihAuthor
New Member
November 9, 2016

Hi Mike,

Thanks for your kindly reply.

This question comes from my Customers,cause their other device (i.e.Router,Switch..) can Authenticated TACACS first. So they think Fortigate should be too.

If I enter account doesn't exist in TACACS but config in local,it will passed right?

Terms & ConditionsAccessibility statement