topic Re: is it possible to Use TACACS authentication? in General Topics

is it possible to Use TACACS authentication?

Gururaj — Wed, 04 Sep 2013 04:52:48 GMT

Hi All,

Is there any tricks to use TACACS authentication? as PaloAlto dos't support TACACS auth directly.

Regards,

Gururaj

Re: is it possible to Use TACACS authentication?

HULK — Wed, 04 Sep 2013 05:48:18 GMT

Hi Gururaj,

As per my knowledgeTACACS is not supported for authentication by PANFW as of now. You can not use tricks, such as changing the port number to 49 instead of 1812 on RADIUS, because message format is different for both RADIUS and TACACS.

RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party.

TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. For debugging purposes, it is useful to have the body of the packets unencrypted. However, during normal operation, the body of the packet is fully encrypted for more secure communications.

Thanks

Re: is it possible to Use TACACS authentication?

mbutt — Wed, 04 Sep 2013 15:23:16 GMT

As per my knowledge TACAS+ is currently no supported.

Currently the authentication for the users can be done based on Radius, LDAP and kerberos.

However if this is something that will be useful in your environment you can ask your Sales Engineer to file a feature request on your behalf.

Hope this helps.

Thank you

Numan

Re: is it possible to Use TACACS authentication?

pulukas — Wed, 04 Sep 2013 15:56:52 GMT

There is a guide to authenticate PA to the Cisco ACS using RADIUS settings.

Configuring Cisco ACS 5.2 for use with Palo Alto VSA