topic Re: TACACS groups in different VRF in Network Access Control

TACACS groups in different VRF

peter.matuska1 — Tue, 24 Nov 2020 19:40:14 GMT

Hi,

does cisco support multiple tacacs groups on the switch and every tacacs group is in different vrf (different IP addresses).

thank you

Re: TACACS groups in different VRF

balaji.bandi — Tue, 24 Nov 2020 20:25:16 GMT

Not sure what is the device IOS running here

here is example : is this helps you ?

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_tacacs/configuration/xe-3s/sec-usr-tacacs-xe-3s-book/sec-vrf-tacas-svrs.html#:~:text=The%20Per%20VRF%20for%20TACACS%2B,(AAA)%20on%20TACACS%2B%20servers.

Re: TACACS groups in different VRF

peter.matuska1 — Tue, 24 Nov 2020 20:30:01 GMT

Hi, the doc mentions only 1 vrf. My goal is to have VRF ONE and configured TAC1 tacacs group inside this VRF. Then I wan to have VRF TWO and TAC2 tacacs group inside this VRF. So if all ports in vrf ONE are down, I will be able to login to the device using TAC2 in vrf TWO. I haven't tried to configure it yet, it it just theoretical question.

Re: TACACS groups in different VRF

balaji.bandi — Tue, 24 Nov 2020 20:42:46 GMT

I have not deployed also tested, as perr the document itself says per VRF. the example give single

you can have more tacacs defined with respect VRF should work.

Nice questions - Nice its time for Lab list for me added

Re: TACACS groups in different VRF

Aref Alsouqi — Wed, 25 Nov 2020 19:02:29 GMT

Yes configuring different aaa groups in different VRFs is supported. However, I did not see this as a very common configuration. Typically you would want to configure the redundancy on the aaa server side, for example, you would have two different RADIUS or TACACS servers, and on the NAD you configure both of them under the same aaa group. But if you want to configure different aaa groups in different VRFs then what you need to do is just to issue the command ip vrf forwarding <the VRF name> under each respective group.