FortiAuthenticator's TACACS Two-Factor Authentication Mechanism

[Bruce7x2]

1.Regarding FortiAuthenticator's support for both Radius and Tacacs, as a Radius Server, it supports CHAP and PAP as multi-factor authentication methods for verification. I would like to know how FortiAuthenticator, as a Tacacs Server, performs multi-factor authentication with Tacacs Clients.

2.Based on the FortiAuthenticator specifications, both physical and virtual versions of FortiAuthenticator support a certain number of "NAS Devices." Does this "NAS Devices" include both Radius Clients and TACACS Clients?

[pminarik]

1, See the notes in: https://docs.fortinet.com/document/fortiauthenticator/6.5.2/administration-guide/738274/adding-clien...
ASCII and PAP are supported only. I will add on top of that that the last time I configured TAC+ authorization, it only worked with ASCII, not with PAP, and was confirmed to be expected to work like that. I do not know if that is still the case, but keep that in mind in case you choose to use PAP and run into issues with authorization requests.

2, The table size limitation is shared among RADIS and TACACS+ clients. Their combined count cannot exceed the limit.

[Bruce7x2]

Dear pminarik,

Thank you for your reply.

Based on your response, does this mean that TACACS only supports Token Appended? From my understanding, token challenge is based on CHAP, but according to the documentation for FortiAuthenticator, it does not support CHAP. Is my understanding correct?

[pminarik · Accepted solution]

That would be incorrect. I have never seen any system require CHAP specifically to provide 2FA functionality.

As a matter of fact, ASCII is probably the only method that is potentially compatible with 2FA in two or more exchanges, because all other methods are described with "MUST consist of a single START packet and a single REPLY".
https://datatracker.ietf.org/doc/html/rfc8907#CommonAuthenticationFlows

Anyway, use ASCII.