topic Re: ISE primary and secondary PSN authentication order in Network Access Control

ISE primary and secondary PSN authentication order

shaheryar.khan — Mon, 04 Apr 2022 09:14:55 GMT

Hello, everyone!

Can someone explain how the switch decides whether to use the primary or secondary PSN when sending Tacacs or Radius authentication requests? It depends on how the switch is configured or something else.

Thanks

Re: ISE primary and secondary PSN authentication order

Rob Ingram — Mon, 04 Apr 2022 10:09:25 GMT

@shaheryar.khan the switch will use the RADIUS Server (PSN) in the order they are configured, until marked as dead, then will use the next configured RADIUS server. You can use the RADIUS Server Load Balancing feature which spreads the aaa load or preferrably a 3rd party Load Balancer, such as F5.

Re: ISE primary and secondary PSN authentication order

Arne Bier — Tue, 05 Apr 2022 01:01:19 GMT

Hi @shaheryar.khan

@Rob Ingram is correct regarding the RADIUS process - there is a concept of dead timer and dead criteria etc.

But what about TACACS+ ? It's my experience on all Catalyst platforms, IOS-XE 16.x and greater, that there is no dead timer or dead criterion to work with. This means that when Primary TACACS+ server fails, then the IOS-XE device goes to the next candidate, until it finds success. Once the TCP transaction is completed, and the next TACACS+ auth comes along, the IOS-XE doesn't remember that Primary Server didn't respond, and it tries it again, top down. This is why we typically need a feature like deadtime to "hold down" the failing server until we think it's safe to use it again.

The consequence of not having this dead "hold-down" timer is that the TACACS+ sessions becomes quite sluggish, as auth and authorization suffer a timeout penalty. The IOS-XE device will continue using on the Secondary TACACS+ server, but the CLI responses will feel sluggish.

I have always wondered whether I am missing a trick, or whether this is by design in IOS-XE TACACS+ implementation.

Re: ISE primary and secondary PSN authentication order

Ib_Reda — Mon, 26 Feb 2024 10:23:55 GMT

Dears

I have the same issue with TACACS+ auth, I have ISE1 and ISE2, on the switch I ordered ISE2 then ISE1, and ISE2 is primary, ISE1 is secondary.

why does the switch automatically authenticate from the secondary?

NOTE: I did not run radius, only i test TACACS.

Re: ISE primary and secondary PSN authentication order

Arne Bier — Mon, 26 Feb 2024 22:01:01 GMT

Share your IOS config here

show run | section tacacs show run | include aaa show tacacs

As was mentioned before, deadtimer concept does not apply to TACACS AAA. It only applies to RADIUS AAA.

TACACS will always try the first server you define in your tacacs Group, even if that server is unavailable.