topic Re: aaa authentication tacacs authentication intermittent work for cisco switch in Network Access Control

aaa authentication tacacs authentication intermittent work for cisco switch

Pawan Raut — Tue, 09 Oct 2018 05:12:13 GMT

aaa authentication tacacs authentication intermittent work for cisco switch. When we capture log on ISE we dont get any logs when aaa tacacs authentication get failed.

Model Number : WS-C3850-48P

Cisco IOS Software, IOS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.02.03.SE RELEASE SOFTWARE (fc2)

Switch aaa configuration as below

aaa group server tacacs+
server-private <ISE1> timeout 2 key <Password>
server-private <ISE2> timeout 2 key <Password>
server-private <ISE3> timeout 2 key <Password>
server-private <ISE4> timeout 2 key <Password>
ip tacacs source-interface Loopback0
aaa authentication login default group ISE-Group local
aaa authentication login console local
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group ISE-Group local if-authenticated
aaa authorization exec console local if-authenticated
aaa authorization commands 1 default group ISE-Group local if-authenticated
aaa authorization commands 2 default local if-authenticated
aaa authorization commands 15 default group ISE-Group local if-authenticated
aaa accounting commands 1 default start-stop group ISE-Group
aaa accounting commands 1 console start-stop group ISE-Group
aaa accounting commands 2 default start-stop group ISE-Group
aaa accounting commands 15 default start-stop group ISE-Group
aaa accounting commands 15 console start-stop group ISE-Group
aaa session-id common

Any lead will help

Re: aaa authentication tacacs authentication intermittent work for cisco switch

Aravind Ravichandran — Tue, 09 Oct 2018 08:18:52 GMT

Hi,

From the configuration i can see aaa group server tacacs+ ISE-Group is missing.

Please refer this document & cross check the configuration

https://community.cisco.com/t5/security-documents/how-to-ise-tacacs-configuration-for-ios-network-devices/ta-p/3631080

Re: aaa authentication tacacs authentication intermittent work for cisco switch

Pawan Raut — Tue, 09 Oct 2018 09:03:33 GMT

that was copy paste error but its not missed in actual device configuration.

Re: aaa authentication tacacs authentication intermittent work for cisco switch

paul — Tue, 09 Oct 2018 12:38:11 GMT

If you have a large volume of TACACS transactions happening you may be timing out periodically due to the large number of TCP connections. This has happened to me before. Enable single connect mode on all your TACACS devices and see if that helps. You also need to enable legacy single connect under the network devices in ISE as well.