topic Re: 3750 tacacs timeout problem in Network Access Control

3750 tacacs timeout problem

jbarger — Mon, 11 Mar 2019 07:45:24 GMT

We have a stack of switches that cant be logged into using tacacs, the configuration is a clone of at least 30 configurations all the other devices use tacacs just fine. When I run a debug I can clearly see tacacs is timing out and it seems like the packet is dropped. I can ping both tacacs servers but I can not telnet to port 49. There is no access list applied and I have changed versions of software. I am currently running 15.0.2.10.

Some debug messages...

001945: .May 31 07:46:59.688: TPLUS: Queuing AAA Authentication request 528 for processing
001946: .May 31 07:46:59.688: TPLUS(00000210) login timer started 1020 sec timeout
001947: .May 31 07:46:59.688: TPLUS: processing authentication start request id 528
001948: .May 31 07:46:59.688: TPLUS: Authentication start packet created for 528(username)
001949: .May 31 07:46:59.688: TPLUS: Using server 192.168.1.1
001950: .May 31 07:46:59.688: TPLUS(00000210)/0/NB_WAIT/80304AC: Started 5 sec timeout

001951: .May 31 07:47:04.696: TPLUS(00000210)/0/NB_WAIT/80304AC: timed out
001952: .May 31 07:47:04.696: TPLUS: Choosing next server 192.168.1.2
001953: .May 31 07:47:04.696: TPLUS(00000210)/1/NB_WAIT/80304AC: Started 5 sec timeout
001954: .May 31 07:47:04.696: TPLUS(00000210)/80304AC: releasing old socket 0
001956: .May 31 07:47:04.696: TPLUS(00000210)/1/NB_WAIT/80304AC: Socket 1 is in wait state

Re: 3750 tacacs timeout problem

dmramirez1 — Wed, 20 Sep 2017 11:07:00 GMT

Can anyone assist with this problem? I have the same.

Re: 3750 tacacs timeout problem

agrissimanis — Wed, 20 Sep 2017 11:47:07 GMT

I had the same problem, TACACS queries were timing out from some switches, but worked on others. I had not restarted the ISE PSN after enabling Device administration service. After PSN restart the problem was fixed. There is also a bug associated with TACACS failing to respond in ISE 2.1 - CSCva93191

Re: 3750 tacacs timeout problem

dmramirez1 — Wed, 20 Sep 2017 15:04:04 GMT

I'll be honest, I am not sure of what you are talking about.

What is the ISE PSN?

I am decently new to Tacacs and until this recent switch haven't have any problems. I have verified connectivity but Ikeep getting Socket 1 is in wait state and then timeouts.

Re: 3750 tacacs timeout problem

agrissimanis — Wed, 20 Sep 2017 15:56:53 GMT

Apologies, I should have asked what product do you use as your TACACS servers?

Re: 3750 tacacs timeout problem

dmramirez1 — Wed, 20 Sep 2017 17:14:38 GMT

Using a Cisco SecureACS

Re: 3750 tacacs timeout problem

agrissimanis — Thu, 21 Sep 2017 14:40:36 GMT

Sorry, I have only used Identity Services Engine as TACACS server, not ACS. There are several reasons why the TACACS server would not respond, such as ACLs blocking the traffic somewhere, bugs on the TACACS server, etc. Try capturing traffic at several places in the network to see how far the request goes.