topic TACACS Proxy with Service-Argument Attribute not working Issue in Network Access Control

TACACS Proxy with Service-Argument Attribute not working Issue

joshhunter — Mon, 15 Jun 2020 12:45:18 GMT

Hello, we are trying to utilize TACACS Proxy for the following scenario,

WLC < ----- > ISE2.6-Patch5 < ----- proxying ----- > Central ISE

We are using the 'Service-Argument' attribute in the proxied request as below screenshot and we see this on both ISE and in packet captures. When we create a rule however it is not matched using this attribute.

The Central ISE does not match this in any of the following cases “EQUALS, CONTAINS, IN, STARTSWITH or MATCHES”.

Re: TACACS Proxy with Service-Argument Attribute not working Issue

Anurag Sharma — Mon, 15 Jun 2020 13:09:11 GMT

Hi @joshhunter

To absolutely confirm that is indeed this attribute which is not letting the Central ISE match that AuthZ rule, can you please remove the condition where you are looking for this.

So, if this attribute is really the problem, you should match that particular AuthZ rule with the other two conditions in place.

Re: TACACS Proxy with Service-Argument Attribute not working Issue

joshhunter — Mon, 15 Jun 2020 13:47:16 GMT

Sorry I forgot to mention, yes it matches rules further down, so it is definitely this attribute.
It needs this attribute to match on we cannot use location, device group, or IP.
Thanks

Re: TACACS Proxy with Service-Argument Attribute not working Issue

Anurag Sharma — Mon, 15 Jun 2020 17:20:39 GMT

@joshhunter ,

How are you "proxying" the requests from one ISE to another?
Which version is the 'Central ISE'?

I'd suggest you enable DEBUG for the component called 'runtime-AAA' on the central ISE and check there.

The log to check would be prrt-server.log.

Check out this article for debugs and logs: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html#anc28

Re: TACACS Proxy with Service-Argument Attribute not working Issue

joshhunter — Mon, 15 Jun 2020 18:24:51 GMT

Central ISE is running 2.7 Patch1 but tried various versions in lab environment.

TACACS PROXY using the external TACACS server pointing ISE to Central ISE.

I will give the debug ago

Thanks

Re: TACACS Proxy with Service-Argument Attribute not working Issue

joshhunter — Tue, 16 Jun 2020 08:47:26 GMT

Hello, I've since tried without TACACS 'Proxy' (Using External TACACS server). It still fails to match.

I tried to match using the service argument of “ciscowlc”. This didn’t match the required rule – again I tried the different options.

Re: TACACS Proxy with Service-Argument Attribute not working Issue

joshhunter — Tue, 16 Jun 2020 15:59:23 GMT

The debugging didn't tell me much.

I suspect it is a BUG and will log.

Thanks

Re: TACACS Proxy with Service-Argument Attribute not working Issue

Anurag Sharma — Tue, 16 Jun 2020 16:51:20 GMT

Alright. Please let us know the findings.