TACACS+ integration with Fortigate Firewall

1. Add the TACACS+ server to the FortiGate using the following commands on the CLI:

config user tacacs+
    edit <server name>
        set authorization enable
        set server <server ip>
        set key <server key>
        set authen-type chap
    next
end

The auto config doesn't work with TACACS+ so you have to set the authentication type as "chap".
You'll find the server key in the configuration file of your TACACS+ server.

2. Create a user group and add the server as a member:

config user group
    edit <tacacs+ group name>
        set member <server name>
    next
end

With this method, any user who has an account on the remote server can authenticate.

Note: Another method would be to create TACACS+ user accounts directly on your FortiGate. In this case, you have to specify which TACACS+ server you want to use for each user you create:

 

config user local
    edit <user name>
        set type tacacs+
        set tacacs+-server <server name>
    next
end

3. Create an admin user set up for remote login, wildcard and a no-access profile.

For this step, you have to be in global context if your FortiGate is configured with vdoms:

 

config global

Start by creating the access profile (minimum level so that the access profile on the TACACS+ server can be set on top of it):

 

config system accprofile
    edit noaccess
    next
end

Then create your admin:

 

config system admin
    edit <profile name>
        set remote-auth enable
        set accprofile "noaccess"
        set vdom "root"
        set wildcard enable
        set remote-group <tacacs+ group name>
        set accprofile-override enable
    next
end

Enabling the override means you will be able to give a TACACS+ admin user more rights than the noaccess profile would allow.

TACACS+ server configuration:

Create your users and user groups in the TACACS+ server configuration file.

A basic example:

 

group = read-only {
    default service = permit
}

An admin group example:

group = admins {
    default service = permit
    service = fortigate {
        admin_prof = super_admin
    }
}

Calling the "fortigate" service and setting "admin_prof" to "super_admin" allows you to give users of this group admin access.

For your users, configure chap as the authentication method to make it work with your FortiGate:

 

user = <regular user name> {
    default service = permit
    member = read-only
    login = cleartext <password>
    chap = cleartext <password>
}

user = <admin user name> {
    default service = permit
    member = admins
    login = cleartext <password>
    chap = cleartext <password>
}

Verification:

In order to check your configuration, use the following command in your FortiGate CLI:

diagnose test authserver tacacs+ <server name> <user name> <password>

This will test the given credentials against the remote server. It will also give you the authenticated user's admin profile.

 

Example output:

 

authenticate user 'fortiadmin' on server 'tac_plus' succeeded

Admin profile: super_admin