topic Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs in Network Access Control

TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

hadeelOth81 — Mon, 28 Oct 2024 20:51:21 GMT

Hello All,

Kindly I need to help to configure TACACS+ (ISE) on a catalyst switch 9500. The 9500 has 2 vrfs and in the aaa group I specified the vrf and the source-interface.

I could successfully login to the switch but can not run any command. it gives me "Authorization Failed" and in ISE the logs show that the command was authorized successfully.

Any suggestions would be helpful.

Thank you,

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

MHM Cisco World — Mon, 28 Oct 2024 20:54:17 GMT

aaa group server tacacs+ group-name

server-private {ip-address | name} [nat] [single-connection] [port port-number] [timeout seconds] [key [0 | 7] string]

ip vrf forwarding vrf-name

ip tacacs source-interface

Do config as above

MHM

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

hadeelOth81 — Mon, 28 Oct 2024 21:07:37 GMT

Hello @MHM Cisco World ,

Unfortunately, it did not work. Still facing authorization failed.

Thanks,

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

MHM Cisco World — Mon, 28 Oct 2024 21:12:57 GMT

Can I see the full config

MHM

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

Cristian Matei — Mon, 28 Oct 2024 21:26:00 GMT

Hi,

Please share complete AAA config, as well as VTY lines and console config, as well as print-screen with ISE TACACS log message.

Best,

Cristian.

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

hadeelOth81 — Tue, 29 Oct 2024 02:50:03 GMT

Here is the configuration

switch1#sh run | sec aaa
aaa new-model
aaa local authentication attempts max-fail 10
aaa group server tacacs+ (Group-Name)
server name ise-name1
server name ise-name2
ip vrf forwarding vrf-name
ip tacacs source-interface Loopback0
aaa authentication login default group Group_Name local
aaa authentication login synchronization none
aaa authorization config-commands
aaa authorization exec default group Group_Name if-authenticated
aaa authorization commands 0 default group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting update newinfo
aaa accounting exec default start-stop broadcast group Group-Name
aaa accounting commands 1 default start-stop broadcast group Group-Name
aaa accounting commands 15 default start-stop broadcast group Group-Name
aaa session-id common

tacacs server ise-name1
address ipv4 IP
key 7 Key

tacacs server ise-name2
address ipv4 IP
key 7 Key

Thank you,

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

MHM Cisco World — Tue, 29 Oct 2024 04:52:02 GMT

As I see you don't use server-private command under group?

Check config I share above

MHM

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

Cristian Matei — Tue, 29 Oct 2024 10:43:14 GMT

Hi,

Command authorization fails as within your config you're referencing globally configured TACACS servers which don't exist, your configuration uses aaa group settings. Perform following changes and it will work:

no aaa authorization commands 0 default group tacacs+ local no aaa authorization commands 1 default group tacacs+ local no aaa authorization commands 15 default group tacacs+ local ! aaa authorization commands 0 default group Group_Name local aaa authorization commands 1 default group Group_Name local aaa authorization commands 15 default group Group_Name local

Best,

Cristian.

Re: TACACS+ (ISE) configuration on a catalyst 9500 with Multiple-vrfs

hadeelOth81 — Tue, 29 Oct 2024 14:53:00 GMT

Thank you @Cristian Matei . It solved the issue.