topic Re: TACACS+ fallback problem ASA 5520 in Network Security

TACACS+ fallback problem ASA 5520

arun.stha — Tue, 12 Mar 2019 02:34:17 GMT

Hi,

I have configured tacacs in ASA 5520, it is working fine, I can login into ASA with tacacs credentials..authentication is successfull when tacacs server is unreachable Local authentication is also successfull.....But after that when Tacacs server is reachable again...I am not able to login with tacacs credentials.

Is the the bug of Cisco ASA 5520 software image?

Below are the configurations:

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ (inside) host 1.1.1.1

key tacacs_key

aaa authentication enable console TACACS+ LOCAL

aaa authentication http console TACACS+ LOCAL

aaa authentication serial console LOCAL

aaa authentication ssh console TACACS+ LOCAL

aaa accounting enable console TACACS+

aaa accounting ssh console TACACS+

aaa accounting command privilege 15 TACACS+

TACACS+ fallback problem ASA 5520

sokakkar — Wed, 11 Sep 2013 17:51:33 GMT

Hi Arun,

Can you take captures on inside interface of ASA when problem occurs? Put the captures in pcap.

Paste debug level logs from ASA and logs from ACS when issue is seen.

Regards,

Sourav Kakkar

TACACS+ fallback problem ASA 5520

Julio Carvajal — Wed, 11 Sep 2013 19:27:46 GMT

Hello Arun,

Can you share the following command with us when the AAA authentication against the tacacs+ database is not working

show aaa-server TACACS+ host 1.1.1.1

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.com

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

Re: TACACS+ fallback problem ASA 5520

Nicolaj Nielsen — Tue, 07 Nov 2017 13:05:21 GMT

Hi, its because after a tacacs+ server fails it remains inactive.

You got 2 options.
1. Is to add "reactivation-mode timed" as an commands under "aaa-server TACACS+ protocol tacacs" it will allow your servicer to automaticly re-activated after 30 seconds.

2. Either way you can add "reactivation-mode depletion" in the same spot; this will only activate the server(s) after all servers in the same pool is failed.

Cheers, Nico