topic TACACS+ Issue with WLC 5508 & ACS 5.1 in Network Access Control

TACACS+ Issue with WLC 5508 & ACS 5.1

goudier2001 — Mon, 11 Mar 2019 01:57:44 GMT

I am trying to implement TACACS authentication against our internal database on the ACS 5.1 for access to our wlc 5508. I have configured the WLC 5508 to use the TACACS which is configured to point our ACS. In the ACS I have configured the relevant shell profile such as Role1, Mandatory & ALL.

When looking into the ACS log it actually shows you that the TACACS access was passed. But when I have tried to login it comes back to the same login box.

I have attached a screen shot of the ACS log.

Any ideas?

TACACS+ Issue with WLC 5508 & ACS 5.1

goudier2001 — Mon, 02 Apr 2012 13:57:52 GMT

Forgot to mention the ACS version 5.1.0.11 & the WLC 5508 is 7-0-220-0

TACACS+ Issue with WLC 5508 & ACS 5.1

jrabinow — Mon, 02 Apr 2012 14:42:38 GMT

Have you installed any patches for ACS 5.1 or are you on the base release

There were in total 6 cumulative patches for ACS 5.1 and at least some of these were applicable to TACACS+ and WLC

I don't remember them all off the top of my head and the release is a bit old but may include the following:

CSCtd24949 - Tacacs authorization failure when authen_type=0

CSCte81150 - ACS 5.x reports key mismatch for unknown authen type

CSCte70900 - ACS 5.1 rejects AP to join WDS domain by "LEAP packet validation failed"

CSCte16911 - ACS 5 doesn't support the PPP tacacs service type for authentication

Not sure I have pointed to a specific oen but I do strongly recommend installing patch 6 for ACS 5.1. Can be downloaded from CCO

TACACS+ Issue with WLC 5508 & ACS 5.1

goudier2001 — Mon, 02 Apr 2012 16:32:42 GMT

Sorry My mistake. The version on the ACS is 5-1-0-44-6

TACACS+ Issue with WLC 5508 & ACS 5.1

Nicolas Darchis — Mon, 02 Apr 2012 18:40:34 GMT

Please post a screenshot of your shell profile. Authentication can pass but if the right attributes are not sent precisely, then nothing will happen on WLC.

TACACS+ Issue with WLC 5508 & ACS 5.1

goudier2001 — Mon, 02 Apr 2012 22:01:10 GMT

Re: TACACS+ Issue with WLC 5508 & ACS 5.1

goudier2001 — Thu, 05 Apr 2012 22:12:25 GMT

It turns out that the attribute entry that I entered had space characters in it which are there by default. This seems to be an undocumented bug. When you enter role1, mandatory then ALL. The ALL field has spaces in it which must be deleted first before entering your command.

TACACS+ Issue with WLC 5508 & ACS 5.1

bmarms — Wed, 15 May 2013 17:45:22 GMT

thanks for posting. i had this issue as well. there were 22 spaces in the "empty" valuse field that were appended to my entered value. once removed, i was able to login.

TACACS+ Issue with WLC 5508 & ACS 5.1

Imran Mirzanaik — Mon, 03 Mar 2014 19:40:30 GMT

Hi All,

I am facing the same issue. I removed blank spaces in the attribute filed but still facing the issues.

Any idea, what could be causing the issue??

thanks

Imran