Set Up TACACS+ for Sophos Firewall Administrators

TACACS+ can verify the sign-in of named Sophos Firewall administrators against a central server. This simplifies password policies and offboarding, but it does not automatically turn the firewall into a fully TACACS+-controlled network device: The actual Device access profile assignment remains local to SFOS.

A safe procedure therefore separates three layers: reachability and the shared secret to the TACACS+ server, successful external authentication of the user, and the local administrator role on the firewall. A green Test connection result proves only the first layer.

Important: Before the change, the local super administrator account admin, a second working management path, and an open local administrator session must be available. Do not make TACACS+ the only method until the pilot sign-in, negative test, and recovery path work.

TACACS+ in ten steps

1. Positively test the local admin, MFA or recovery procedure, and management access.
2. Document the TACACS+ server, firewall source address, TCP port, shared secret, and pilot account.
3. Allow the TACACS+ path only over a trusted management network or a protected tunnel.
4. Add a TACACS+ server under Authentication > Servers > Add.
5. Use Test connection to check credentials and reachability, then save.
6. Authenticate the pilot user once through an already approved firewall service so the user object is created.
7. Under Authentication > Users, deliberately make the pilot user an administrator and assign a minimal Device Access profile.
8. Under Authentication > Services > Administrator authentication methods, add TACACS+, set the order, and retain Local as a deliberate fallback.
9. Test WebAdmin positively in a private browser window and negatively with an unauthorized user.
10. Only then add more administrators, review logs, and test a TACACS+ path outage in a controlled manner.

What SFOS controls with TACACS+

Sophos Firewall uses the configured TACACS+ server as an authentication method for selected services. Under Authentication > Services, SFOS lists PAP and CHAP for TACACS+. The method that actually fits must be agreed with the peer and confirmed in the server log.

The current SFOS 22 help does not document automatic mapping of a TACACS+ attribute to a Sophos administrator profile. A user from an external server appears as a standard user on first sign-in and receives administrator rights only after a local assignment. Microsoft Entra ID SSO is an explicitly documented exception with role or group mapping.

The general ability of the TACACS+ protocol to provide authorization and accounting is also not the same as documented SFOS command authorization. For this runbook:

• TACACS+ verifies the external identity and password.
• SFOS defines the user type and Device Access profile locally.
• configuration-audit.log remains the evidence for configuration changes on the firewall.
• A TACACS+ permit alone does not authorize a user for WebAdmin.

For local role planning, see Set Up Sophos Firewall Administrators and Profiles Securely.

Example and prerequisites

The example uses:

• Server name: TACACS-HQ
• Server IP: 10.20.30.15
• Port: 49
• Pilot user: fw-noc-pilot
• Device Access profile: NOC-ReadOnly
• Management network: 10.20.40.0/24

10.20.30.15 and 10.20.40.0/24 are private documentation values and must be replaced with the real server address and approved management network. TCP 49 is the registered default port for TACACS+, but the port entered in SFOS must match the peer exactly. Do not document the shared secret in screenshots, tickets, or this example.

Before configuration, clarify the following:

• The TACACS+ server knows the firewall’s actual source address as a client or Network Access Server.
• Routing and the firewall path between the firewall and server work in both directions.
• The pilot account is active on the TACACS+ server and allowed for the intended authentication type.
• A dedicated Device Access profile with None, Read-only, and only the required Read-write permissions is prepared.
• WebAdmin is reachable only from the intended management network.
• The local admin account works independently of TACACS+.
• Backup, maintenance window, and recovery path are documented.

The current SFOS form documents an IP address, port, and shared secret for TACACS+, but no TLS switch. Classic TACACS+ does not protect the packet contents like a modern TLS connection. Therefore, the server path must not cross the internet or an untrusted network without protection. Stop the production rollout if only an insecure transport path is available.

Add the TACACS+ server to the firewall

Menu path:

Authentication > Servers > Add

Procedure:

1. Set Server type to TACACS+ server.
2. Enter a unique Server name, for example TACACS-HQ.
3. Enter the real Server IP and the Port configured on the server.
4. Store the same Shared secret as on the TACACS+ peer.
5. Use the approved pilot account for Test connection.
6. Save only after a successful test.

The connection test verifies user credentials and connectivity to the server. It does not prove that the user already has an administrator profile, that WebAdmin is reachable from the user’s network, or that a real administrator sign-in works.

If the test fails, first check server IP, route, port, shared secret, client definition, and the server log. Do not change authentication methods or administrator roles on suspicion.

Safely make an external user an administrator

Users from external servers become visible under Authentication > Users after they first sign in successfully to a firewall service. For the pilot, use an already approved service, such as User Portal or VPN Portal. If no such path exists, do not create a broad WAN exposure solely to create the user record.

Keep the procedure narrow:

1. Allow the chosen portal or authentication service only from the management network.
2. Add TACACS+ to exactly this authentication method without removing existing fallbacks.
3. Sign in the pilot user successfully once.
4. Under Authentication > Users, verify that the external user object appeared.
5. Open the user and set User type to Administrator.
6. Assign the prepared profile, for example NOC-ReadOnly.
7. Restore any temporary portal or method permissions that are no longer needed to their documented previous state.

Do not grant an external user the full Administrator profile as a precaution. First test a read-only or narrowly scoped role. Only accounts whose tasks require write permissions should receive them.

Change Administrator authentication methods

Menu path:

Authentication > Services > Administrator authentication methods

Add TACACS+ to the list of selected servers. If several servers are selected, SFOS forwards the request in the displayed order. The order is therefore part of the security design, not a cosmetic value.

For the pilot:

1. Add TACACS+ to the selected list.
2. Move the server to the planned position.
3. Keep Local as a deliberate fallback for named local administrators.
4. Select Apply.
5. Keep the existing admin session open.

The Administrator authentication methods explicitly do not apply to the local super administrator admin. This account remains the independent emergency path and is protected separately with a strong password, MFA, and restricted network access.

Set authentication methods same as firewall couples administrator sign-in to the methods used for firewall authentication. Use this option only when that coupling is intentional and documented. An explicit list is easier to verify and restore for a clear administrator pilot.

Validate WebAdmin and the role

A successful acceptance test verifies more than the password dialog:

1. Keep the local admin session open.
2. Sign in the pilot through the intended WebAdmin FQDN in a private browser window.
3. Verify the assigned profile: expected menus are visible and unauthorized areas are absent.
4. With Read-only, a controlled change must not be saved.
5. For an intended write role, use a harmless test change with a documented rollback.
6. A valid TACACS+ user without a local administrator role must not open WebAdmin.
7. An incorrect password must be rejected.
8. The local admin must still be able to sign in in a second private window.
9. Correlate the TACACS+ server log, Log Viewer, and configuration-audit.log by time.

WebAdmin reachability is controlled separately under Administration > Device access or with a narrow Local Service ACL exception. TACACS+ and MFA do not justify broad WAN exposure. The secure network path is covered in Device Access and Local Service ACL.

Check logs and HA

In Log viewer, filter by the pilot user, source IP, and test time. For deeper analysis, use:

• access_server.log for authentication, authorization, and accounting on SFOS
• configuration-audit.log for changes, administrator, and time
• syslog.log for system and administrator-triggered events
• the TACACS+ server log for client address, user, method, and result

In an HA cluster, do not assume that an existing WebAdmin session survives a failover without interruption. After a planned role change, perform a fresh sign-in and check which firewall source address actually appears on the TACACS+ server. If the server permits clients by source address, deliberately allow all addresses that occur in the real HA path.

Logs reside on the node that processed the event. For a time-ambiguous HA case, check both nodes or a consolidated view.

Troubleshoot by symptom

Test connection fails

Check server IP, route, TCP port, shared secret, client definition, and server status. A packet capture can show whether the firewall reaches the server and which source IP it uses. Do not continue with user roles if there is no response or the source IP is unexpected.

Test connection works, but WebAdmin rejects the user

This is consistent with a missing local administrator profile. Under Authentication > Users, verify that the user exists, User type: Administrator is set, and the correct Device Access profile is assigned. Then check the order under Administrator authentication methods and the WebAdmin ACL.

The server accepts the password, but the wrong profile applies

TACACS+ does not automatically assign the local Sophos profile in this SFOS workflow. Check the user object and profile on the firewall. Do not invent server attributes or grant the full Administrator profile as a quick test.

Sign-in works only until an HA failover

Check the actual source IP of the new sign-in on the TACACS+ server. Then verify route, port, client definition, and shared secret for the active path. An old browser session is not proof of success; use a new session.

All external administrator sign-ins fail

Sign in with the local admin, check server status and method order, and if necessary remove TACACS+ from the administrator list in a controlled manner. Do not expand Device Access to Any or restart the authentication service as the first step.

For cross-method diagnosis, see Troubleshoot Sophos Firewall Authentication Systematically.

Offboarding and rollback

For offboarding, first disable the user on the TACACS+ server. Then check whether an existing session is still active on the firewall and whether the local external user object still has an administrator profile. Do not treat a server-side disable as a guarantee that every existing WebAdmin session ends immediately.

After the negative test, remove the local administrator profile or disable the user. Document audit and server logs with the ticket and time. The super administrator account admin is not part of this normal offboarding process.

Rollback after a failed pilot:

1. Use the open local administrator session.
2. Remove TACACS+ from Administrator authentication methods or restore its documented former position.
3. Restore temporary portal and Device Access permissions to their previous state.
4. Remove the local administrator role from the pilot user or disable the user.
5. Test a new local administrator sign-in and the normal authentication path.
6. Only then delete the TACACS+ server entry if no other function uses it.

Checklist

• local admin, MFA, and recovery path tested
• actual firewall source address known on the TACACS+ server
• TCP port and shared secret match
• server path is in a trusted or protected network
• Test connection successful but not mistaken for WebAdmin proof
• pilot user visible as an external user object
• User type: Administrator and a minimal profile assigned locally
• Local retained as a deliberate fallback
• positive and negative WebAdmin tests passed
• WebAdmin reachable only from the intended management network
• access_server.log, server log, and audit trail correlated
• HA or failover tested with a fresh sign-in
• offboarding and rollback documented

Frequently asked questions