topic Re: Secondary TACACS server in Network Access Control

Secondary TACACS server

ttran01 — Sun, 10 Mar 2019 14:40:55 GMT

I need some assistance on configuring a secondary TACACS server. I have a primary and secondary server. I would like AAA requests send to the secondary server whenever the primary is either down or the service on the primary has stopped. Any ideas?

Re: Secondary TACACS server

jhillend — Tue, 24 Feb 2004 22:03:08 GMT

If this is for IOS, just configure a second server (the secondary server) on IOS:

tacacs-server x.x.x.x key xyz

Re: Secondary TACACS server

ttran01 — Tue, 24 Feb 2004 22:42:28 GMT

Unfortunately I tried that and it doesn't work the way I want it to. I have both the primary and secondary configured and when I stop the primary services it does not fall back to the secondary it just falls to the local. Thanks for the feedback. Any other ideas?

Re: Secondary TACACS server

pigotts — Sat, 28 Feb 2004 23:43:08 GMT

Did you set the server groups?

aaa group server tacacs+ {mygroup1}

nn.nn.nn.nn key abcd

nn.nn.nn.nn key defg

then modify the authen/author/acct lines to reflect the group name vs. the default of tacacs+

Steve

Re: Secondary TACACS server

pvanvuuren — Sun, 29 Feb 2004 19:54:19 GMT

You can consider two methods:

The old school one like this -

aaa new-model

aaa authentication login default group tacacs+ local

tacacs-server host 10.1.122.11

tacacs-server host 10.2.32.13

tacacs-server key abcdef

or, try a group method like this:

aaa new-model

aaa group server tacacs+ ABCGROUP

server 10.1.1.5

server 10.1.1.13

aaa authentication login default group ABCGROUP line

tacacs-server host 10.1.1.5

tacacs-server host 10.1.1.13

tacacs-server key abcdef

Because the shared key (secret) cannot be configured in the group config you must define those tacacs servers again at the end of the config.

Make sure you have connectivity to both before testing. Stop the service on your primary ACS and keep an eye on the reports to see the passed and failed authentications.

Here;s another tip:

By making the fall-back authentication "line" you can immediatly distinguish between a Tacacs Login and line Login. Tacacs will show: "Username:" and Line will prompt "Password:"

Let me know how things go.

Cheers

Re: Secondary TACACS server

ttran01 — Mon, 01 Mar 2004 20:41:17 GMT

It worked with the group method. Thanks for everyone's help.