TACACS
This chapter contains information on using TACACS authetication with your FortiSwitch unit.
Administrative Accounts
Administrative, or admin, accounts allow access to various aspects of the FortiSwitch configuration. The level of access is determined by the access profile used in the admin account.
Configuring an Access Profile for Admin Accounts
Using the web-based manager:
- Go to System > Admin > Admin Profile and select Create New.
- Give the profile an appropriate name.
- Set Access Control as desired, choosing between None, Read Only, or Read-Write.
- Select OK.
Using the CLI:
config system accprofile edit <name> set admingrp {none | read | read-write} set loggrp {none | read | read-write} set netgrp {none | read | read-write} set routegrp {none | read | read-write} set sysgrp {none | read | read-write}
end
end
Configuring a TACACS Admin Account
Using the web-based manager:
- Go to System > Admin > Administrators and select Create New.
- Give the administrator account an appropriate name.
- Set Type as
- Set User Group to a group for remote users.
- Enable Wildcard.
- Set Admin Profile to use the new profile.
- Select OK.
Using the CLI:
config system admin edit tacuser set remote-auth enable set wildcard enable set remote-group <group> set accprofile <profile>
end
end
User Accounts
User accounts can be used to identify a network user and determine what parts of the network the user is allowed to access.
Configuring a User Account
config user tacacs+ edit <tacserver> set authen-type {ascii | auto | chap | ms_chap | pap} set authorization enable set key <authorization_key> set server <server>
end
end
Configuring a User Group
config user group edit <tacgroup> set member <tacserver> config match edit 1 set server-name <server> set group-name <group>
end
end
end
end
Example Configuration
The following is an example configuration of a TACACS user account, with the CLI syntax shown to create it:
TACACS Managing a FortiSwitch unit with a FortiGate
- Configuring a TACACS user account for login authentication: config user tacacs+ edit tacserver set authen-type ascii set authorization enable set key temporary set server tacacs_server
end
- Configuring a TACACS user group:
config user group edit tacgroup set member tacserver config match edit 1 set server-name tacserver set group-name tacgroup
end
end
end
end
- Configuring a TACACs system admin user account:
config system admin edit tacuser set remote-auth enable set wildcard enable set remote-group tacgroup set accprofile noaccess
end end