topic Re: TACACS + Radius authentication in Network Access Control

TACACS + Radius authentication

williamehmke1 — Tue, 25 May 2021 14:42:25 GMT

I was wondering if anyone has successfully configured both TACACS and Radius on Cisco devices for aaa. We are looking to move to TACACS and have it reside on our ISE PSN's but I want to still keep radius as a backup as it will continue to reside on VM's outside of the ISE PSN's.

Any input is greatly appreciated

Re: TACACS + Radius authentication

Marvin Rhoads — Tue, 25 May 2021 15:17:17 GMT

I haven't had the occassion to do it but you should be able to put method lists for both in sequence for your aaa authentication commands. The device will always try the servers first in the list and only use the second method if all servers time out from the first method.

Re: TACACS + Radius authentication

williamehmke1 — Tue, 25 May 2021 16:50:31 GMT

ok Thank you. I will try find some examples to reference and then give it a try

Re: TACACS + Radius authentication

lrojaslo — Tue, 25 May 2021 19:56:25 GMT

You can have up to 3 different methods for login for example:

aaa authentication login default group tacacs(first method) group radius (fallback) local (2nd fallback)

Fallback to next method will occur only if there is no communication with previous method.