topic tacacs config on ASR 1001 in Network Access Control

tacacs config on ASR 1001

yanliu2007 — Mon, 11 Mar 2019 01:14:21 GMT

Hi all,

I'm trying to configure Tacacs on Cisco ASR1001, and the Tacacs server is Cisco ACS v3.3, the ACS won't pass the authentication, complaining bad request from NAS, key mismatch - which I compared millions of times on both ASR and ACS sides. below is my config, did I miss anything?

cisco ASR1001, version IOS-XE Software (X86_64_LINUX_IOSD-UNIVERSAL-M), Version 15.1(1)S

aaa new-model

aaa group server tacacs+ TACACS

server-private 192.168.10.20 key 7 xxxx

ip vrf forwarding Mgmt-intf

aaa authentication login default group TACACS local

aaa authorization config-commands

aaa authorization commands 1 default group TACACS if-authenticated

aaa authorization commands 15 default group TACACS if-authenticated

ip tacacs source-interface GigabitEthernet0

tacacs config on ASR 1001

Javier Henderson — Thu, 21 Jul 2011 11:50:50 GMT

Hello,

Are you using Network Device Groups on your ACS configuration? If so, please check the group settings for a shared secret, if defined it will take precedence over any keys assigned to each individual AAA client contained within that group.

tacacs config on ASR 1001

yanliu2007 — Thu, 21 Jul 2011 18:14:19 GMT

Thanks Javier,

we reset the shared key many times and by reboot the ACS made it work. thank you.