topic Nexus Allows TACACS and Local Authentication Concurrently in Network Access Control

Nexus Allows TACACS and Local Authentication Concurrently

efairbanks — Mon, 11 Mar 2019 01:08:34 GMT

Community,

I am experiencing an issue where NX-OS on our 5010s is allowing both Local AND TACACS authentication concurrently. If I don't configure any aaa authorization commands, the locally logged in user has unmitigated access to the device. Once I enable aaa authroization, all commands issued by the locally logged in user are denied by ACS, but they can still log in to the device. When I comb through the logs on the ACS server, I see successful logins when TACACS credentials are used, and also the failed attempts when the locally configured credentials are used. On the switch, however, I receive "%TACACS-3-TACACS_ERROR_MESSAGE: All servers failed to respond" when using locally configured credentials on the switch itself. We are running ACS v4.2.

See attachment for configuration information from the switch.

Thanks in advance for any assistance.

-Erik

Nexus Allows TACACS and Local Authentication Concurrently

Tarik Admani — Tue, 07 Jun 2011 07:45:56 GMT

I wanted to know what the reason for the failed attempts are in the acs logs? If you can set the logging to full and then search for the username in the TCS.logs after you repro the issue and then download the support bundle. This will show you if ACS is failing the user or if ACS is returning error messages to the Nexus thus failing over to local authentication.

Keep in mind when setting the logging to full and downloading the package.cab file will restart the services on the box.

Thanks,

Tarik

Nexus Allows TACACS and Local Authentication Concurrently

efairbanks — Wed, 08 Jun 2011 06:17:04 GMT

Tarik,

The folks in the lab were able to duplicate the problem. Since we would rather provide Cisco logging info from the lab and not the production environment, they are going to open a TAC case on my behalf.

Once a solution is provided, I will update this forum post for the benefit of the community.

Thanks again for your help.

-Erik

Nexus Allows TACACS and Local Authentication Concurrently

John Galietta — Mon, 12 Sep 2011 20:38:35 GMT

Erik,

I am experiencing the same problem on my Nexus 5548 and 7010 switches. Have you made any progress on your case with TAC? I would be most interested to find out more.

Thanks,

John

Nexus Allows TACACS and Local Authentication Concurrently

Nathan Eger — Wed, 05 Oct 2011 20:14:05 GMT

Erik-

I encountered the same issue. Any update from TAC on what the issue was?

-Nathan

Nexus Allows TACACS and Local Authentication Concurrently

andrea.meconi — Tue, 15 Nov 2011 10:35:23 GMT

Hello Erik.

I encountered the same issue. Any update from TAC?

Regards.

Andrea

Nexus Allows TACACS and Local Authentication Concurrently

efairbanks — Tue, 15 Nov 2011 10:42:32 GMT

Yes...sorry....I did get this working. If you configure the AAA authentication line with the tacacs option, but omit the "local" parameter, you will achieve your desired results - localmauthentican will work only if tactics fails. Not sure if this is a bug or a code difficiency...