Technical Tip: Use VSA attributes to assign administration profiles using TACACS+ authentication under FortiSwitch

[Adolfo_Z_H]

Description

This article describes how to use VSA attributes to assing administration profiles using TACACS+ authentication under FortiSwitch.

Scope

All FortiSwitch models and versions.

Solution

FortiSwitch devices support RBAC for administrative access. It is possible to use VSA attributes to assing an access profile when remote autenticate users using TACACS+ by sending group-name atributte value on TACACS+ successful authtentication response.

Consider that by default, FortiSwitch devices have only a prof_admin profile.

config system accprofile
    edit "prof_admin"
        set admingrp read-write
        set exec-alias-grp read-write
        set loggrp read-write
        set mntgrp read-write
        set netgrp read-write
        set pktmongrp read-write
        set routegrp read-write
        set swcoregrp read-write
        set swmonguardgrp read-write
        set sysgrp read-write
        set utilgrp read-write
    next

It is possible to create as many access profiles as needed on the same configuration section and customize access as needed.

    edit "prof_read"
        set admingrp read
        set exec-alias-grp read
        ...trunked output...

        set utilgrp read

end

Now it is possible to configure user groups and identify a user group using the group-name VSA attribute value as a value for the remote-group under the user group configuration.

config user group
    edit "full-acces"
        set member "test"
            config match
                edit 1
                    set server-name "TACACS"
                    set group-name "full-admin" <---- group-name VSA TACACS value.

                next

            end
    edit "ro-access"

        set member "ro-access"

            config match

                edit 1
                    set server-name "TACACS"
                    set group-name "ro-admin" <---- group-name VSA TACACS value.

    next
end

Then assign administration profiles to a remote user group:

config system admin
    edit "ADMIN"
        set remote-auth enable
        set accprofile "prof_admin" <------ Access profile.
        set wildcard enable
        set remote-group "test" <---- User group.
    next

    edit "RO_ADMIN"
        set remote-auth enable
        set accprofile "prof_read" <------ Access profile.
        set wildcard enable
        set remote-group "ro-access" <---- User group.

end

Refer to the article below to know the general TACACS+ configuration process on a FortiSwitch device:

Technical Tip: Configure TACACS+ under FortiSwitch