Tacacs and local account authentication order problem

Forum|Forum|8 years ago
March 27, 2018
4 replies
7754 views

Hello !

My software version is:

I got 100D with firmware v5.6.3 build1547 (GA)

I have simple question about user authentication order: tacacs before local account. This is typical scenario when tacacs server is reachable, fortigate should use remote authentication. When tacacs server isn't reachable for authentication should be used local account.

How i can do that ?

I configured authentication with tacacs and every time i login with remote user i have strange message:

This account is using the default password, it is strongly recommended that you change your password.

Of course password isnt default... How i can avoid this message/problem ?

Thanks for help

Best Regards

MM

emnoc

New Member

Okay 1st , if your doing wildcards; " the FGT calls back to the tacacs server for that username "

if the tacacs server is "down" and the user account is not on the FGT the auth will fail

if you define the user locally with no remote-auth it uses the local-password

if you define the user locally and with tacacs it uses the tacacs credentials

i don't believe you can have a falback with the "same user" if tacacs is not available, if you need HA for tacacs, uses 2 or more tacacs-servers

On the default password, change the local-password from "admin" to something else.

Ken

codythejackAuthor

New Member

Hi !

Thanks for response.

1. I changed account admin from local to remote. This works. I can log with password from tacacs server. I noticed so there is button "change backup password." What is it for ?

I changed backup password for something different then tacacs admin password. Unfortunately when tacacs server was not accessable this password doesnt work. I cannot log in with it.

2. Changing default password didnt change anything (message still appears). I heard it should be fixed in next release of firmware.

Marcin