topic Re: Nexus 7000 and ACS AV-PAIRS in Network Access Control

Nexus 7000 and ACS AV-PAIRS

cochambe — Sun, 10 Mar 2019 23:49:55 GMT

Dear all,

I'm having an issue with TACACS+ AAA setup with a Nexus 7000 running 4.2(2a) and ACS 4.2. I've added the av-pair string of

shell:roles="network-operator vdc-admin" into the TACACS+ settings under the group custom attributes. When I log in I the login hangs
waiting for the custom attribute pair to respond back the switch which it doesn't seem to do and it then dumps me into vdc-operator role and not the
vdc-admin role.

Can any one give me any additional pointers? 

Thanks in advance,

Col

Re: Nexus 7000 and ACS AV-PAIRS

cochambe — Tue, 08 Dec 2009 10:31:22 GMT

All,

Just for reference we've fixed this. The based VDC always seemed to honour the PRIV 15 under the ACS group and gave you network-admin, the correct syntax for vdc-admin passthrough on the av-pair is:

shell:user=admin-vdc

That's all you need.

Regards,

Col

Re: Nexus 7000 and ACS AV-PAIRS

cratejockey — Mon, 08 Feb 2010 19:52:34 GMT

Colin,

I saw your post and figured I would give you a shout. I have a client with a 7K installed. We are running ACS 4.2 and all network equipment is functioning with the exception of the 7K.

We keep getting:

TACACS-3-TACACS_ERROR_MESSAGE: All servers failed to respond

Do you have a sample of your config for your 7K? Did you have to do anything special in ACS for it to talk to the 7K? Been beating my head on this for a few weeks and the Cisco Config guides don't solve my issue. Follow them to a tee and still does not work.

Thanks,

Josh

Re: Nexus 7000 and ACS AV-PAIRS

khwajanusrat — Tue, 23 Feb 2010 17:18:44 GMT

Hi,

I am also getting this message repeatedly on my NX5000, although the authentication and authorization are working fine. Will appreciate any clues. thanks

%TACACS-3-TACACS_ERROR_MESSAGE: All servers failed to respond

Re: Nexus 7000 and ACS AV-PAIRS

khwajanusrat — Tue, 23 Feb 2010 22:03:23 GMT

Hi Colin Chambers,

Can you please post the error and the current config for tacacs on NX7000.

Re: Nexus 7000 and ACS AV-PAIRS

brian.holmes — Wed, 16 Feb 2011 15:09:20 GMT

My server was sending minor version 0 instead of 1 when I saw the same error message.

Nexus 7000 and ACS AV-PAIRS

Yun Pan — Thu, 16 May 2013 20:24:54 GMT

Nexus 7000 and ACS AV-PAIRS

veer.pratap — Mon, 22 Jul 2013 17:14:49 GMT

Hi Colin,

Can u help me to resolve the issue of ACS 4.2 with nexus 7k. wat configuration u did in ACS ?

Regards,

Veer Pratap Singh

Nexus 7000 and ACS AV-PAIRS

brian.holmes — Tue, 23 Jul 2013 17:27:59 GMT

One other thing I had to send was TACACSPLUS-Priv-Level = ROOT

which by the way was not in any manual.