Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
StevenT
New Contributor III

fortigate Tacacs+

Hi,

 

wonder anyone had encountered this before? I had checked everywhere for solutions or help, but not much information.

 

Fortigate firmware is 7.0.6

We had configured the Tacacs+ in fgt but could not communicate with the Tacacs+ server.

We follow the guide, FGT 7.0.6 > Administration Guide > TACACS+ servers.

1 Solution
kvimaladevi
Staff
Staff

Hi StevenT,

 

If you are still facing issues, please check if the traffic is sent from the Fortigate and if there is a drop from the firewall or from the server. 

diag sniffer packet any 'port 49' 4 0 a 

you can stop the debug using the command ctrl+c

putty 2:

#diagnose debug reset

#diagnose debug flow filter daddr x.x.x.x <--- IP address of the tacacs server
##diagnose debug flow show function-name enable

#diagnose debug flow trace start 1000
ping the tacacs server
#diagnose debug enable

 

You can stop the debug using the command di de di

Please check the tracert from the firewall cli to check until which hop the traffic reaches.

 

Regards,

Vimala

View solution in original post

2 REPLIES 2
ebilcari
Staff
Staff

Did you configure FGT as a client in the TACACS server? Be aware that since FGT have many IPs it will choose the IP of the interface it uses to reach the server. The TACACS server will drop the requests if it's not sourced by the one that is specified as the client IP.
You can change the configured IP on the server or manually set up a source IP in FGT via CLI:

config user tacacs+
edit "TAC"
set source-ip x.x.x.x

 

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
kvimaladevi
Staff
Staff

Hi StevenT,

 

If you are still facing issues, please check if the traffic is sent from the Fortigate and if there is a drop from the firewall or from the server. 

diag sniffer packet any 'port 49' 4 0 a 

you can stop the debug using the command ctrl+c

putty 2:

#diagnose debug reset

#diagnose debug flow filter daddr x.x.x.x <--- IP address of the tacacs server
##diagnose debug flow show function-name enable

#diagnose debug flow trace start 1000
ping the tacacs server
#diagnose debug enable

 

You can stop the debug using the command di de di

Please check the tracert from the firewall cli to check until which hop the traffic reaches.

 

Regards,

Vimala

Labels
Top Kudoed Authors