Configuring TACACS+ authentication

You can configure administrator authentication using a Terminal Access Controller Access-Control System Plus (TACACS+) server.

You can login to FortiDDoS 3 ways:

Local Username, Password, Admin Profile, Trusted hosts (optional)
- No TACACS+ required. It is highly recommended that at least one local super_admin_pro(file) is available as well as the admin/super_admin_profile that cannot be deleted.
- TACACS+ is not used
Local Username, Admin Profile, Trusted hosts (optional) with TACACS+ password management and no local password.
No local username or password – TACACS+ provides login credentials, with Admin Profile and Trusted Hosts in Shell Profiles and Custom Attributes.

Correct credentials with no Shell Profiles and Custom Attributes results in a login with no access.

Once you complete the TACACS+ Server Configuration, create an administrator user under System > Admin > Administrator page and select TACACS+ as the Strategy. When TACACS+ is selected, no local password option is available. You can also specify Admin (access) profile and trusted host list for that user. For more details about creating a user profile, see here.

Note: Any access profile (read-only, read-write or none combinations) is usable for GUI users. CLI users must have “super_admin_prof” Profile or they will be rejected.

The FortiDDoS-F does not currently support TACACS+ Attribute pairs or Two Factor Authentication (2FA).

Before you begin:

You must have Read-Write permission for System settings.

To configure FortiDDoS for TACACS+ authentication:

Go to System > Authentication > TACACS+.

Complete the TACACS+ Server Configuration.

Settings	Guidelines
Status	Select to enable TACACS+ server configuration or deselect to disable.
Primary Server IP	IP address or FQDN of the primary TACACS+ server.
Primary Server Secret	TACACS+ server shared secret – maximum 116 characters (special characters are allowed).
Port	TACACS+ port number in the range: 1 - 65535. The default value is 49.
Secondary Server IP	(Optional) IP address or FQDN of a backup TACACS+ server.
Secondary Server Secret	(Optional) TACACS+ server shared secret – maximum 116 characters (special characters are allowed).
Authentication Protocol	PAP - Password Authentication Protocol CHAP - Challenge Handshake Authentication Protocol (defined in RFC 1994) ASCII Auto - Automatically selects one of the above protocols.

Save the configuration.

CLI commands:

config system authentication tacacs+ 
  set state {enable|disable}
  set primary-server <ip|domain>
  set primary-secret <string>
  set port <port>
  set backup-server <ip|domain>
  set backup-secret <string>
  set authprot {pap|chap|ascii|auto}
end

TACACS+ ACS Shell Profiles and Custom Attributes

Shell Profiles

For Admin Profiles, create TACACS+ Shell Profiles like the sample below. Shell Profiles must match case and spelling of the Admin Profile configured in FortiDDoS:

Custom Attributes

Under the Custom Attributes tab, add the custom attributes based on the Shell profile. For example:

AdminProf:
- Fortinet-FDD-Access-Profile: super_admin_prof
- Fortinet-FDD-Trusted-Hosts: 172.30.153.0/24
  
  Custom Attributes spelling and case must match the above.