FGT Accounting on Cisco ISE - TACACS+ Live Logs

[guicarvalho_]

Hello Team,

I've just configured a Fortigate to authenticate via TACACS+ on Cisco ISE. All is working as expected, but it doesn't show the command accounting on TACACS Live Logs, only authentication logs.

If I go to Operations > Reports > Device Admin > TACACS Command Accounting, I can see all logs from command accounting.

Is it a normal Cisco ISE behaviour to show that just in Reports and not at Live Logs?

Thx

[Arne Bier]

Hi @guicarvalho_ 

I haven't configured TACACS+ on Forti's, but on Cisco IOS devices you will see Authentication, as well as (command) Authorizations in TACACS+ Live Logs. 

Command Accounting is different to Command Authorization. The ISE Live Logs show AuthN and AuthZ - the command Accounting is not show in Live Logs. As you stated, you see command Accounting in Reports only

[Ruelb2214]

Hello @guicarvalho_ are you able to share the docs or URL how you able to configure TACACS+ on FTG with Cisco ISE authorization

Thank u!