topic Re: TACACS Suppression in Network Access Control

TACACS Suppression

Allen P Chen — Tue, 18 Apr 2017 04:30:32 GMT

Hello,

I understand in ISE, repeated RADIUS requests can be suppressed under Administration>System>Settings>Protocols>RADIUS. Screenshot attached.

Are there plans to extend this suppression capability to TACACS?

The scenario is customer runs a monthly vulnerability scan on their infrastructure devices (switches, WLCs, firewalls). Vulnerability scan software makes repeated login attempts on the infrastructure devices, which is flooding ISE and causing adverse performance issues. Can suppression be configured for TACACS requests as well? If not, what is the recommended workaround?

Thanks in advance.

Re: TACACS Suppression

hslai — Tue, 18 Apr 2017 21:09:27 GMT

No, log suppression is for RADIUS only but not for T+. No known workaround.

Re: TACACS Suppression

thomas — Tue, 18 Apr 2017 21:13:32 GMT

Recommended workaround is to throttle their tool's usage to a more acceptable level of performance impact.

Re: TACACS Suppression

Allen P Chen — Tue, 18 Apr 2017 21:18:30 GMT

Hi Hsing and Thomas,

Thanks for the replies. I have already provided the customer recommendations, including limiting access to infrastructure devices to management endpoints, control plane policing for management protocols on infrastructure devices, etc. However, as ISE is positioned as the replacement for ACS, and since there is RADIUS suppression available, I would think TACACS suppression should be a natural extension of that.

Thanks again for the insights.

Re: TACACS Suppression

thomas — Tue, 18 Apr 2017 21:24:04 GMT

I'll forward your request to the Product Manager!

Re: TACACS Suppression

rwehe — Mon, 22 Oct 2018 18:02:35 GMT

Hello, I have a customer asking this same question and I'm wondering if there's any discussions with the BU that came of this feature request. The customer would like to suppress the service account logs that they see in their TACACS Live Logs. Currently I recommended a filter but they'd like to know if there's a way to do it without a filter.

Thanks!

Re: TACACS Suppression

hslai — Mon, 22 Oct 2018 20:22:46 GMT

The fix CSCvb45390 is likely coming in next patch releases of shipping ISE 2.x.