Hi,
wonder anyone had encountered this before? I had checked everywhere for solutions or help, but not much information.
Fortigate firmware is 7.0.6
We had configured the Tacacs+ in fgt but could not communicate with the Tacacs+ server.
We follow the guide, FGT 7.0.6 > Administration Guide > TACACS+ servers.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi StevenT,
If you are still facing issues, please check if the traffic is sent from the Fortigate and if there is a drop from the firewall or from the server.
diag sniffer packet any 'port 49' 4 0 a
you can stop the debug using the command ctrl+c
putty 2:
#diagnose debug reset
#diagnose debug flow filter daddr x.x.x.x <--- IP address of the tacacs server
##diagnose debug flow show function-name enable
#diagnose debug flow trace start 1000
ping the tacacs server
#diagnose debug enable
You can stop the debug using the command di de di
Please check the tracert from the firewall cli to check until which hop the traffic reaches.
Regards,
Vimala
Did you configure FGT as a client in the TACACS server? Be aware that since FGT have many IPs it will choose the IP of the interface it uses to reach the server. The TACACS server will drop the requests if it's not sourced by the one that is specified as the client IP.
You can change the configured IP on the server or manually set up a source IP in FGT via CLI:
config user tacacs+
edit "TAC"
set source-ip x.x.x.x
Hi StevenT,
If you are still facing issues, please check if the traffic is sent from the Fortigate and if there is a drop from the firewall or from the server.
diag sniffer packet any 'port 49' 4 0 a
you can stop the debug using the command ctrl+c
putty 2:
#diagnose debug reset
#diagnose debug flow filter daddr x.x.x.x <--- IP address of the tacacs server
##diagnose debug flow show function-name enable
#diagnose debug flow trace start 1000
ping the tacacs server
#diagnose debug enable
You can stop the debug using the command di de di
Please check the tracert from the firewall cli to check until which hop the traffic reaches.
Regards,
Vimala
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.