topic Cisc ISE problem with TACACS in Network Access Control

Cisc ISE problem with TACACS

umeshunited — Thu, 09 Aug 2018 21:32:15 GMT

Hi All,

I am having problem with my ISE and legacy switches.

I have to delete switch and re add it to ISE in order to make TACACS work.

Is there any compatibility issue with legacy deivces ?

Re: Cisc ISE problem with TACACS

Nidhi — Fri, 10 Aug 2018 04:18:20 GMT

What is the switch model here ? you might want to check the data sheet for this switch.

as long as this switch supports TACACS+ functions, it will work with ISE.

Thanks,

Nidhi

Re: Cisc ISE problem with TACACS

paul — Fri, 10 Aug 2018 12:07:12 GMT

What issue are you having? There are many version of TACACS configs and TACACS has been around for many years. All should work with ISE, but the syntax on the switch is different and what features of TACACS are supported are different depending on IOS version.

Re: Cisc ISE problem with TACACS

umeshunited — Sat, 11 Aug 2018 11:56:28 GMT

Hi Nidhi,

We have 3750 having code, 12.2 . After applying aaa configuration on switch it did not work. I had to remove switch from ISE and re added it.

Re: Cisc ISE problem with TACACS

umeshunited — Sat, 11 Aug 2018 11:56:59 GMT

Hi Nidhi,

We have 3750 having code, 12.2 . After applying aaa configuration on switch it did not work. I had to remove switch from ISE and re added it.

Re: Cisc ISE problem with TACACS

umeshunited — Sat, 11 Aug 2018 12:05:01 GMT

Hi Pual ,

We are having mix of old and new switches. So we have prepared two set of commands.

We are facing strange issue. We first added all switches in ISE. Now when we configure aaa on switch it won't work. We have to remove that switch and add it again in ISE then only it will work.

Also first we will try set-1 commands if it does not work we will go for set-2.

---------- Set - 1 (For latest IOS versions)--------------

tacacs server AUTH

address ipv4 x.x.x.x

key KEYVALUE

aaa group server tacacs+ Tacacs_Server

server name AUTH

ip tacacs source-interface XXX

------------- Set -2 (Old versions)--------------

aaa group server tacacs TACACS_Servers

server x.x.x.x

tacacs-server host x.x.x.x key KEYVALUE

ip tacacs source-interface XXX

Re: Cisc ISE problem with TACACS

michaeljosuecruza — Sun, 12 Aug 2018 02:35:38 GMT

Hello umeshunited,

Could you

1. What error shows or be more explicit when it says "it stops working"

2. The present problem is only with the legacy

3. You have new switches working with TACACS +

4. What version of Cisco ISE has running.

Thank you for your time, I am waiting to help.

Best regards,

Re: Cisc ISE problem with TACACS

umeshunited — Sat, 25 Aug 2018 17:53:10 GMT

Hi michaeljosuecruza

Client has currently paused ISE installation , so as of now no progress from client.

Thank you.

Re: Cisc ISE problem with TACACS

hslai — Thu, 30 Aug 2018 18:31:30 GMT

As you were able to get it to work by removing and re-adding the network devices to ISE, it's potentially an issue in ISE. Please open a TAC case to troubleshoot if the project later resumed and the problem continuing.

Re: Cisc ISE problem with TACACS

thomas — Fri, 31 Aug 2018 15:51:28 GMT

It sounds like this is better handled as a troubleshooting session with TAC since you aren't providing enough useful details (switch configs, policy screenshots, etc.)