Tacacs and local account authentication order problem

[codythejack]

Hello !

My software version is:

I got 100D with  firmware v5.6.3 build1547 (GA)

I have simple question about user authentication order: tacacs before local account. This is typical scenario when tacacs server is reachable, fortigate should use remote authentication. When tacacs server isn't reachable for authentication should be used local account.

How i can do that ?

I configured authentication with tacacs and every time i login with remote user i have strange  message:

This account is using the default password, it is strongly recommended that you change your password.

Of course password isnt default... How i can avoid this message/problem ?

Thanks for help

Best Regards

MM

[emnoc]

Okay 1st , if your doing wildcards; "  the  FGT  calls back to the tacacs server for that username "

if the tacacs server is "down" and the user account is not on the  FGT the  auth will fail

if you define the user locally with no remote-auth it uses the local-password

if you define the user locally and with tacacs  it uses the tacacs credentials

i don't believe you can have a falback  with the "same user" if tacacs is not available, if you need HA for tacacs, uses 2 or more tacacs-servers

On the default password, change the local-password from "admin" to something else.

Ken

[codythejack]

Hi !

Thanks for response.

1. I changed account admin from local to remote. This works. I can log with password from tacacs server. I noticed so there is button "change backup password." What is it for ?

I changed backup password for something different then tacacs admin password. Unfortunately when tacacs server was not accessable this password doesnt work. I cannot log in with it.

2. Changing default password didnt change anything (message still appears). I heard it should be fixed in next release of firmware.

Marcin

[rickguthier]

This is a very common scenario. Is there a cookbook for setting this up?  If not could step by step details be shared?

Thanks

[gdifiore]

You are right.  the changing default password is a bug when using remote authentication sources.  TAC did confirm it is going to be fixed in the next release.