configuring tacacs in multi-vdom firewall

[Daryaya]

Hi,

our firewall is in version 7.6 and we have multi-vdom. I notice that from the vdoms, I can configure tacacs: #config user tacacs+, however when I'm in global, I don't have this command.

is that a way to configure it under Global (#config global #config user tacacs+ ) rather than going to individual vdom and do it (#config vdom #edit x #config user tacacs)?

Also if I have a ha cluster (active-passive), I suppose I don't need to config anything on passive devices, as the config getting synchronised through all the firewalls?

Thanks

[AEK]

Hi

User config is per VDOM. It is not configurable in global.

Yes in active passive HA all configuration is synchronized automatically, including user configuration.

[Daryaya]

thanks, so I have to replicate users in every vdom, rather than adding them in global and define which vdoms they can have access?

[AEK]

Yes that's right. You replicate users in every VDOM.

With VDOMs it is just like if you have multiple firewalls. So each firewall has its own config.

[grotesque]

Hey there.

You mean to configure for administrator users?

Thanks.

[Daryaya]

configure tacacs, so use tacacs to authenticate users rather than adding local users.

[Toshi_Esumi]

Are those "users" are like VDOM specific VPN users or admin users to mage one VDOM (vdom admin)? If global admin users instead, those need to be defined or remote authenticated (like via TACACS) from a management VDOM (by default "root").

Toshi

[Daryaya]

Yes, I meant admin users. so adding #config user tacacs on only root vdom is sufficient to create user admins that access to all vdoms? thanksd 

[Toshi_Esumi · Accepted solution]

Yes. That's what we do for mutil-vdom(customers) environment with TACACS authentication for those admin users, who manage all vdom(customers) config.
Although the TACACS config is in management (in your case "root") vdom, the admin configuration is still under "config global" -> "config sys admin". Then you can refer to the TACACS server or a group of servers you definded in management (root) vdom.

The management vdom works as kind of a central vdom, which communicate with FortiGard and some others, which doesn't specifically belong to any other vdoms. As you realized, "global" doesn't have any capability to communicate with outside of the box. So the management vdom does that and that's why the management vdom needs to have a connectivity to the internet.

Toshi

[Toshi_Esumi]

And, to understand what's in "global", you can do "config global" -> "show | grep '^config'" to see all config components in it.
You would see like
config system global
config system interface
config system admin
config system ha
config system dns
and so on.