Does FTD support TACACS+?

[ricky-ho]

Does Firepower Threat Defense (the latest version) support TACACS+?

edit: Does Firepower Management Center support TACACS+ either?

[Rob Ingram · Accepted solution]

@ricky-ho unfortunately not no. FTD/FMC latest versions only support external authentication using LDAP or RADIUS.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/100/management-center-admin-10-0/system-users.html#id_63531

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215538-configure-firepower-management-center-an.html

https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/221009-configure-fmc-and-ftd-external-authentic.html

[Cristian Matei]

Hi,

@ricky-ho Not yet. Not aware of any roadmap on this, my personal opinion is that it's not gonna be supported anytime soon. I might be wrong, though.

Thanks,

Cristian.

[Stefan Mihajlov]

@ricky-ho Noup 🙂

[balaji.bandi]

In case you are looking for Radius-based device access  , look below the thread recently tested with the latest FMC and FTD 7.7

https://www.balajibandi.com/?p=2807

[Marvin Rhoads]

As noted by others, not at this time. 

Cisco has resisted adding the support since legacy TACACS+ (developed in the 1990s) is considered insecure. Perhaps that will change now that they are offering TACACS over TLS (https://www.rfc-editor.org/rfc/rfc9887.html) in ISE and on the latest IOS.

IOS example here: https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/225097-configure-tacacs-over-tls-1-3-on-an.html - the article incorrectly cites RFC 8446 which is TLS 1.3 itself.