topic Re: I think ASA is blocking TACACS+ traffic in Network Security

I think ASA is blocking TACACS+ traffic

Mohd Khairul Nizam — Mon, 22 Jun 2020 11:42:18 GMT

Re: I think ASA is blocking TACACS+ traffic

Marvin Rhoads — Sun, 27 May 2018 03:51:18 GMT

Is your firewall also doing NAT?

the best check would be to run packet-tracer. tcp packet, source outside interface, your router IP, source port 1025, dest your AAA server, dest port 49.

Re: I think ASA is blocking TACACS+ traffic

Mohd Khairul Nizam — Tue, 23 Jun 2020 06:59:57 GMT

there is no NAT in place in the ASA

for packet tracer , why does source port is 1025 ?

here is the trace

Re: I think ASA is blocking TACACS+ traffic

Marvin Rhoads — Sun, 27 May 2018 15:01:37 GMT

@Mohd Khairul Nizam

We use 1025 as the source port because tcp communications by default use some ephemeral port number for source (i.e. >1024 and <64k).

Your trace indicates the traffic is coming FROM the .65 host (Voice Group) and TO the .70 host (Voice GW). Are they on the same subnet (the trace indicates they are)? If so, you must permit traffic on same-security level explicitly.

Re: I think ASA is blocking TACACS+ traffic

Mohd Khairul Nizam — Sun, 27 May 2018 23:41:25 GMT

Yes, both is in same subnet , /26

how should i permit it, mean need to add additional ACL ?

Re: I think ASA is blocking TACACS+ traffic

Marvin Rhoads — Mon, 28 May 2018 03:12:57 GMT

Try adding the command:

same-security-traffic permit intra-interface

...and then repeat the packet-tracer test.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s1.html

Re: I think ASA is blocking TACACS+ traffic

Mohd Khairul Nizam — Mon, 28 May 2018 04:10:10 GMT

boot system disk0:/asa832-k8.bin
ftp mode passive
clock timezone MY 8
dns server-group DefaultDNS
domain-name aia.biz
same-security-traffic permit intra-interface

already key in the command, and then packet-tracer again but still not go through

Re: I think ASA is blocking TACACS+ traffic

Mohd Khairul Nizam — Mon, 28 May 2018 06:58:39 GMT

i manage to got it cover and resolve it

create a rules allowing the tacacs server passing the ASA to the destination router.
Thanks a lot.