| Description | This article describes how to troubleshoot TACACS requests which are going through the HA management interface. |
| Scope | FortiGate. |
| Solution |
When the HA management interface is configured, it is expected that traffic like TACACS, Syslog, and Radius connection requests will go towards the HA management interface if 'set ha-direct enable' under 'config sys ha' as shown below
It is expected the packets towards the TACACS connection will be sent through the management interface. In order to make this connection follow through the normal routing table, it is necessary to make the 'ha-direct' option disabled.
Once done, all the firewall-initiated connections will follow the normal routing table.
Soon after disabling this ideally, the packet has to take a routing table decision.
The source-ip can be specified the CLI under TACACS server configuration to route the traffic through a data interface:
config user tacacs+
edit "server_name"
set source-ip x.x.x.x <----- Set the desired interface IP address.
end
|
