topic Re: Tacacs authentication not working in Network Access Control

Tacacs authentication not working

davidcruise — Sun, 10 Mar 2019 22:57:54 GMT

i have AAA server , when i configure tacacs authentication on edge switch , no response from AAA to the edge switch , but for radius configuration it is working

Re: Tacacs authentication not working

Richard Burts — Wed, 09 Jul 2008 14:05:46 GMT

Hani

You have not provided much for us to work with. Based on your description I would think that the problem might be one of these things:

- perhaps the switch configuration for the tacacs server is not correct?

- perhaps the switch configuration of the shared key with the tacacs server is not correct?

- perhaps the IP address chosen by the switch as the source for the tacacs request is not the same address that is configured on the tacacs server for this client.

- perhaps there is some error in the switch configuration for tacacs configuration.

I would suggest that a good place to start investigating this issue is in the logs of the tacacs server. Is the server seeing the authentication request? If so then there may be some error code that indicates what the problem is. If the server is not seeing the request then it point to a different kind of problem.

It would also be helpful to post the switch config so we can check for issues in the switch config.

HTH

Rick

Re: Tacacs authentication not working

davidcruise — Wed, 09 Jul 2008 14:43:34 GMT

- i am sure of the tacacs configuration of the switch .

-the switch & ACS are reachable to each other

& no communication problem.

-for test i installed the acs on VMWare which resides on the ACS server itself, i give the VMWare ip address 192.168.170.12 , which is in the same range of ACS server ip address 192.168.170.11

& changed the Tacacs server ip address on the edge switch from 192.168.170.11 to 192.168.170.12 , & tacacs authentication worked fine .

Re: Tacacs authentication not working

Jagdeep Gambhir — Wed, 09 Jul 2008 14:53:10 GMT

David,

If incase this is acs appliance, then disable remote logging and see if that make tacacs authentication work.

Regards,

~JG

Re: Tacacs authentication not working

davidcruise — Fri, 11 Jul 2008 07:55:04 GMT

no it is not acs appliance

Re: Tacacs authentication not working

cisco24x7 — Fri, 11 Jul 2008 10:23:16 GMT

According to what you said, it is reasonable

to say that the ACS server is having issues.

I would the following:

1- from the switch telnet to the ACS server

via port 49 and see port 49 is listening:

C3750#telnet 10.250.97.28 49

Trying ... Open

[Connection closed by foreign host]

C3750#

2- to confirm that tcp port 49 is listening

on the ACS server, do "netstat -an | findstr

49"

3- I am guessing that the CSTacacs service

is not running but the CSRadius is. Check

the Windows service and restart CSTacacs

service and see if you can restart it.

Re: Tacacs authentication not working

Jagdeep Gambhir — Fri, 11 Jul 2008 11:48:06 GMT

Other then that also check how aaa server is setup i.e Go to acs--->network configuration---->AAA server----> Make sure it is set up as "Cisco Secure ACS" and not Radius.

Regards,

~JG

Re: Tacacs authentication not working

chaitu_kranthi — Fri, 11 Jul 2008 18:20:56 GMT

Hi,

If you are having Multiple Vlan in the Switch then also this problem will come.

issue a command

"ip tacacs source-interface Vlan 1"

may this sloves your problem.