topic Re: Tacacs single-connection in Network Access Control

Tacacs single-connection

lni1 — Mon, 17 Dec 2018 13:11:29 GMT

Dear Cisco,

After running into the session limit (20k) of our ISE 3495, we followed tacacs recommendation of Cisco TAC to implement single-connection feature:

We encountered some issues during our POC:

We change the config to : tacacs-server host IP single-connection key xxx
We try to connect to the switch : NOK (enable & conf mode not possible)
When we check the “single-connection” box in ISE of the device everything works fine again.

This seems to happen on all C3560 (12.2(53)SE2)

Is there Cisco recommendation concerning where to implement this feature?

On the switch
On ISE
Both

Kind regards,

Lieven Stubbe

Infrabel

Re: Tacacs single-connection

ognyan.totev — Mon, 17 Dec 2018 13:53:37 GMT

I think this is expected. You configure the switch single-connection to one side but if you not configure the ISE single connection tick box it will ignore single connection from switch . Thats why it work after you check the tick box.

Re: Tacacs single-connection

lni1 — Mon, 17 Dec 2018 14:02:23 GMT

We only have this behaviour on our C3560 devices, so my question remains: on which side do you need to activate the single-connection feature?

Lieven

Re: Tacacs single-connection

ognyan.totev — Mon, 17 Dec 2018 14:03:25 GMT

I think on both is correct answer

Re: Tacacs single-connection

lni1 — Thu, 20 Dec 2018 11:41:55 GMT

Hello Cisco,

Did some Wireshark and it seems that "both" is the correct answer, when you disable the feature on ISE and/or Switch the TACACS stream is split in several TCP sessions. When active on both ends, everything is in one TCP session.

Kind regards,

Lieven Stubbe

Infrabel

Re: Tacacs single-connection

kevink707 — Thu, 15 Aug 2019 17:19:08 GMT

Any issue with the TACACs server running out of resources with single connect if you have thousands of TACACS clients? I'm thinking 10K to 20k clients, each with a an open TCP connections when single-connection configured.