topic Re: AAA in Network Access Control

AAA

liram2307 — Wed, 12 Feb 2025 10:13:24 GMT

Hi, in my packet tracer im trying to make aaa authentication + ssh/telnet.
i have a big project, 3 branches, bgp , asa and so on..
in one branch it works good but in another branch it doesnt work correctly as it should be, i'v tried everything i know, but it doesnt recognize the aaa users and not even the local ones.. i can ping the aaa server.

in the pkt.file, its "סניף אילת" which is the right one between the 3 branches (clusters).

the middle branch "סניף חיפה" is working as it should.

Re: AAA

Flavio Miranda — Wed, 12 Feb 2025 10:26:54 GMT

@liram2307

Which device are you trying to access using ssh and from what PC?

Re: AAA

liram2307 — Wed, 12 Feb 2025 10:29:30 GMT

Hi, forgot to mention it. from router RB-C-ELT, through the gig0/0 (tried loopback 0), and from any pc in the branch.

Re: AAA

Flavio Miranda — Wed, 12 Feb 2025 10:43:10 GMT

I dont see any tacacs configuration on the router. Not sure if I am looking the right place.

https://www.cisco.com/c/pt_br/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/10368-basictacacs.html

Re: AAA

liram2307 — Wed, 12 Feb 2025 10:49:52 GMT

oops, sry wrong pkt file, here is the updated one.
and here is an img shows what router + server

Re: AAA

Flavio Miranda — Wed, 12 Feb 2025 18:02:35 GMT

@liram2307

One problem I saw is that you have 10.1.1.254 on both routers, this can cause problem when tacacs server will reply.

But, this is not enough to make it work. There is something else and I could not identify. This configuration is pretty straitforwad and yours is pretty much ok. I am wondering is there is any issue if the router or the packetrracer for this particular config. You may want to test in a small topology with another router model just to make sure.

Re: AAA

liram2307 — Wed, 12 Feb 2025 18:21:22 GMT

hi, i somehow made it work.. i just did it over and over again and it works now.. i dont know why it didnt work before but as long as it works i will not touch it, hehe. thanks for the help anyways! have a wonderful day!

Re: AAA

zsgbrt4 — Tue, 18 Feb 2025 18:02:07 GMT

Check AAA configs on סניף אילת:

Ensure correct AAA authentication method (aaa authentication login default group radius local).
Verify radius server settings (IP, shared secret, ports). Spotify MOD
Confirm VTY line authentication (login authentication default).
Check routing/firewall rules between the branch and AAA server.

Since סניף חיפה works, compare its configuration with סניף אילת to spot differences. Let me know if you need further debugging steps!

Re: AAA

liram2307 — Fri, 14 Feb 2025 18:39:04 GMT

hi, i'v managed to make it work as i wrote before. ty for your time!