topic Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands in Network Access Control

Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Thu, 02 Feb 2023 00:10:59 GMT

Hi There,

I have 2 C9500 L3 switches setup successfully authenticating to 2 ISE 2.6.0.156 servers using the following command set:

aaa group server tacacs+ ISE_SERVERS
server-private 10.x.x.1 key 7 blablabla
server-private 10.x.x.2 key 7 blablabla
ip tacacs source-interface Vlanxxx

aaa authentication login default group ISE_SERVERS local
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group ISE_SERVERS local if-authenticated
aaa accounting exec default start-stop group ISE_SERVERS
aaa accounting commands 0 default start-stop group ISE_SERVERS
aaa accounting commands 1 default start-stop group ISE_SERVERS
aaa accounting commands 15 default start-stop group ISE_SERVERS
aaa accounting network default start-stop group ISE_SERVERS
aaa accounting network SSH start-stop group ISE_SERVERS

Now if I apply the same config as above to some other switches (connected to the C9500's. I cannot get ISE to authenticate to logon. I can ping the ISE servers from the offending switches & ISE can ping the switches OK.

If I change the config on the offending switches to the following, everything works fine! Just wondering what could be the difference with using 'server-private' in the ISE_SERVERS tacacs+ group as opposed to using just the tacacs server command?

aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ local

tacacs server ISE_SERVER
address ipv4 10.x.x.1
key 7 blablabla

Thanks!

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

balaji.bandi — Thu, 02 Feb 2023 00:20:51 GMT

some other switches - need more information on what model of the switch and what IOS code running.

Cat 9500 latest IOS XE code - so the syntax changed looking into future config directions.

some old models based on IOS we need to use what is suggested.

i do see different config methods in different models of routers and switches.

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

MHM Cisco World — Thu, 02 Feb 2023 00:28:13 GMT

ip tacacs source-interface Vlanxxx <<- are this VLAN interface is UP ??

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Thu, 02 Feb 2023 00:36:21 GMT

Hi @MHM Cisco World - yes vlan is up

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

MHM Cisco World — Thu, 02 Feb 2023 00:37:25 GMT

ping ISE using VLAN interface as source

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Thu, 02 Feb 2023 00:41:52 GMT

Hi @balaji.bandi - other switches include:

IE-5000-12S12P-10G running 15.2(7)E3

IE-4010-16S12P running 15.2(7)E2

The C9500's that are working are:

C9500-48Y4C running Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.12.5b, RELEASE SOFTWARE (fc3)

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

balaji.bandi — Thu, 02 Feb 2023 00:51:56 GMT

Configuring TACACS+ ( see the syntax supported)

https://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie4010/software/release/15-2_4_EC/configuration/guide/scg-ie4010_5000/swauthen.html

Other note: Cat 9500 running an old version (may be ROMMON version you showing) check if you running 16.12.X upgrade to 17.6.4 lot of security and bug fixed. the code 16.12,X no longer advised by TAC.

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

iskandar — Thu, 02 Feb 2023 01:30:46 GMT

I recall in the past I had to use "server-private" when connecting to tacacs servers via a management VRF.

But then again as some one mentioned above the tacacs configuration can differ from different cisco router/platforms, software versions.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_tacacs/configuration/xe-16/sec-usr-tacacs-xe-16-book/sec-vrf-tacas-svrs.html

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Thu, 02 Feb 2023 01:36:38 GMT

pings OK using VLAN interface as source

NSxxx#ping 10.x.x.1 source vlan xxx
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.x.x.1, timeout is 2 seconds:
Packet sent with a source address of 10.x.x.x
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Thu, 02 Feb 2023 01:42:12 GMT

OK after testing with some of these suggestions I have realised that the 'private-server' commands are working on any of the L2 switches, no matter which model it is (IE5K & 4010). On the IE5K's that have routing enabled it doesn't work & I have to use the 'tacacs server' commands which do work. Why would this make any difference?

As stated above I can ping the ISE interface useing the source option.

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

hslai — Sun, 05 Feb 2023 00:47:56 GMT

@benbroadfoot, "ip tacacs source-interface Vlanxxx" seems part of aaa server group only. Perhaps, that is causing it. Anyhow, good to verify no asymmetric routing by packet captures, etc.

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

MHM Cisco World — Sun, 05 Feb 2023 11:18:09 GMT

I make deep dive and I think find solution here,
I will share detail later today or max tomorrow.

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Mon, 06 Feb 2023 22:46:16 GMT

Hi @MHM Cisco World - any luck with this? very interested to hear what you have found! 🙂

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

MHM Cisco World — Mon, 06 Feb 2023 22:50:05 GMT

sure I will share tonight,

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

Nancy Saini — Tue, 07 Feb 2023 13:58:59 GMT

Hi @benbroadfoot

Another way of testing reachability to TACACS server is "test aaa group <server group name> <user> <password> new-code" and check TACACS live logs on the server to check if it received any request.

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Sun, 12 Feb 2023 23:56:20 GMT

Hi @MHM Cisco World - can you please share when you have a chance? Thanks 🙂

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

MHM Cisco World — Tue, 14 Feb 2023 22:59:28 GMT

Hi
I dont forget you but I was busy,
can I ask you some about your config ?
1- are you use any VRF in your SW
2-what is the IOS version you run

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Tue, 14 Feb 2023 23:59:15 GMT

Hi @MHM Cisco World - no problems mate, any help from you guys is greatly appreciated!

1 - No VRF's are used

2- C9500-48Y4C running Cisco IOS XE Software, Version 16.12.05b (working with aaa group server tacacs+ ISE_SERVERS ISE config)

IE-5000-12S12P-10G running IOS 15.2(7)E3 (connected to above C9500 & not working with aaa group server tacacs+ ISE_SERVERS ISE config but does work with the other ISE commands)

Thanks!

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

MHM Cisco World — Wed, 15 Feb 2023 00:05:33 GMT

same config except use server instead of server-private
aaa group server tacacs+ ISE_SERVERS
server 10.x.x.1 key 7 blablabla
server 10.x.x.2 key 7 blablabla
ip tacacs source-interface Vlanxxx <<- you confirm that this VLAN is in global not in mgmt-vrf

Re: Tacacs+ 'aaa group server' vs 'tacacs server' commands

benbroadfoot — Wed, 15 Feb 2023 00:21:17 GMT

just using "server 10.x.x.1" does not accept the 'key' command which is required.

The Vlanxxx is global yes