topic Re: Tacacs and GRE Tunnel in Network Access Control

Tacacs and GRE Tunnel

awairlines — Sun, 10 Mar 2019 14:14:07 GMT

Tacacs authentication doesn't work after passing thru GRE tunnel with Crypto map.

Re: Tacacs and GRE Tunnel

gfullage — Wed, 02 Apr 2003 00:45:06 GMT

We need more information than that please if we're going to help you.

What version of router code on both sides? Can you ping to the TACACS server over the tunnel with all different sizes of packets (up to and including 1500bytes)? What does the log on the ACS server say, anything in Failed Attempts or Passed Authentications? Are you sure you're sourcing the TACACS packets from the same interface as the IP address you have entered in as the NAS on the ACS server (check for Unknown NAS errors in the Failed Attempts log)?

Re: Tacacs and GRE Tunnel

awairlines — Wed, 02 Apr 2003 16:24:53 GMT

OK - here is some more info:

router versions local 12.2(6b) remote 12.2(5d)

Ping sweep min to max OK

ACS message "Unknown NAS"

Source address is serial int of remote router in ACS device config

debug aaa on remote router shows a TAC+ send authen/start

then it has status "error" - then drops to line authentication

Thanks...

Re: Tacacs and GRE Tunnel

gfullage — Thu, 03 Apr 2003 01:20:03 GMT

OK, thanks.

If you're getting Unknown NAS in ACS, then the TACACS packet is being sourced with a different router address than what you entered in ACS for that NAS. You should be able to see what address the router is using by looking at the Unknown NAS error message. you can either then add that address is for the NAS, or use the "ip tacacs source-interface ..." command to specify what address the router uses.

Re: Tacacs and GRE Tunnel

awairlines — Thu, 03 Apr 2003 16:15:23 GMT

The "ip tacacs source-interface" resolved the issue...

Re: Tacacs and GRE Tunnel

ben_johnson — Thu, 24 Apr 2008 01:28:31 GMT

I had a similar problem where the router was on the end of a GRE tunnel and could ping the ACS (tacacs) server but could not use it for authentication. The "ip tacacs source-interface" command resolved my problem.

Cheers,

Ben.

Re: Tacacs and GRE Tunnel

guruprasadr — Sun, 27 Apr 2008 19:11:38 GMT

Hello All, [Pls Rate if HELPS]

In addition,

Normally in the CRYPTO Configuration the Crypto Sessions will be formed with some Private Loopback available in the Configuration.

Since the TACACS Server will be in the same domain, so the "ip tacacs source-interface" command solved the problem of Urs.

The Crypto Originating LOCAL Interface at SPOKE Location, should be normally used for tacacs Source Interface in a general scenario.

Hope I am Informative.

Pls Rate if HELPS

Best Regards,

Guru Prasad R