Cisco ISE TACACS+ to Fortigate Read/ Write and Read Only configuration

[RG78874]

Hello,

I am working on some Fortinet's and for anyone that has connected Fortinet's to Cisco ISE using tacacs+ I could really do with some help.

TACACS+ > Active Directory > Separate Read Only group and Read/Write Group

Article that I am using to configure this - https://sharifulhoque.blogspot.com/2019/09/fortigate-using-radius-server-windows_4.html

(Yes it says Radius but it's got Tacacs+ config steps)

Can you see anything in the guide that I would be missing from my configuration.

I've got a successful connection to tacacs+

I have a connection to Active Directory.

I have Read / Write and Read Only AD groups, I'm not sure what else I am missing or if anyone can help.

I'm using version 3.1 and Fortigate version 7.4.x

Fortinet Guide hasn't got much info, but Fortinet side is configured.

[ccieexpert]

what is the behavior you are seeing ? are you able to login ?

have you run the diagnose command as per the example ?

Please attach the relevant config for fortigate and also screenshots of how it is configured in ISE

[RG78874]

Screen shots are not available. I can see Tacacs Live Log errors show

Authentication Details section:

Message text Failed-Attempt: Authentication failed

Failure Reason 13036 Selected Shell profile is DenyAccess

The Shell profile is configured as per article in my post.

[MHM Cisco World]

https://youtu.be/2WPuc7r_Qe4?si=lREegAb0cWIXCE-Y

Check this 

MHM

[RG78874]

@MHM Cisco WorldThanks I checked it, but this is Radius setup. I am using Tacacs+

ISE setup for this is different

[RG78874 · Accepted solution]

All fixed, device policy admin set

[Jhonleo02]

Ensure the user roles in Cisco ISE are correctly mapped to your AD groups for both read-only and read/write access. Also, verify that TACACS+ policies are properly assigning these roles. Discover more by reviewing detailed role-mapping configurations for any missing steps.

[RG78874]

Thanks @Jhonleo02 one problem... I have read/write access and I cannot get cli or ssh to type any commands for example "config system admin" any ideas what i need to allow on ISE for this?

[Jhonleo02]

TACACS+ policies might not be assigning the correct privilege level for CLI access. Double-check the command sets and ensure that the read/write group is permitted to execute CLI commands like "config system admin." Additionally, confirm that your user roles in Cisco ISE are properly configured to provide the necessary administrative access.

[gordonmckenna6]

Based on your description, it seems you've configured the essential components: successful TACACS+ connection, Active Directory integration, and defined Read/Write and Read-Only AD groups. However, to ensure proper role assignment on the FortiGate, verify that the attribute-value pairs sent by Cisco ISE match FortiGate's expected values. Specifically, check that the TACACS+ service custom attributes in ISE correspond to the appropriate admin profiles on the FortiGate. If these attributes are misconfigured or missing, FortiGate may not assign the correct permissions.

[gordonmckenna6]

---

@RG78874 wrote:

Hello,

I am working on some Fortinet's and for anyone that has connected Fortinet's to Cisco ISE using tacacs+ I could really do with some help.

TACACS+ > Active Directory > Separate Read Only group and Read/Write Group

Article that I am using to configure this - https://sharifulhoque.blogspot.com/2019/09/fortigate-using-radius-server-windows_4.html

(Yes it says Radius but it's got Tacacs+ config steps) writing seo content vancouver

Can you see anything in the guide that I would be missing from my configuration.

I've got a successful connection to tacacs+

I have a connection to Active Directory.

I have Read / Write and Read Only AD groups, I'm not sure what else I am missing or if anyone can help.

I'm using version 3.1 and Fortigate version 7.4.x

Fortinet Guide hasn't got much info, but Fortinet side is configured.

---

Based on your description, it seems you've configured the essential components: successful TACACS+ connection, Active Directory integration, and defined Read/Write and Read-Only AD groups. However, to ensure proper role assignment on the FortiGate, verify that the attribute-value pairs sent by Cisco ISE match FortiGate's expected values. Specifically, check that the TACACS+ service custom attributes in ISE correspond to the appropriate admin profiles on the FortiGate. If these attributes are misconfigured or missing, FortiGate may not assign the correct permissions.