topic Re: Adding tacacs to NDFC in Nexus Dashboard

Adding tacacs to NDFC

TroyBolton — Thu, 21 Aug 2025 12:30:25 GMT

Hi,

We're trying to add tacacs to NDFC and we're getting an error saying "unable to validate provider. Please check your configuration"

Any advice?

Re: Adding tacacs to NDFC

M02@rt37 — Thu, 21 Aug 2025 12:46:06 GMT

Hello @TroyBolton

Please share screen of menu and error output.

Re: Adding tacacs to NDFC

TroyBolton — Thu, 21 Aug 2025 12:59:42 GMT

Re: Adding tacacs to NDFC

M02@rt37 — Thu, 21 Aug 2025 13:15:59 GMT

Thanks @TroyBolton

shure for PAP ?

Possible to check on your TACACS+ serveur if flows from NDFC come ? No any FW on the way ?

Re: Adding tacacs to NDFC

TroyBolton — Thu, 21 Aug 2025 14:18:55 GMT

Not PAP but CHAP, not sure how or where to check if there is any traffic from NDFC, no firewalls at all.

Re: Adding tacacs to NDFC

bharsch — Thu, 18 Sep 2025 16:50:05 GMT

usually, it's the AV pair being returned...

1. make sure ALL ND nodes are in TACACS network devices. AAA requests can come from any of them
2. Make sure TACACS is approving the AAA requests
3. make sure you're returning a valid AV pair.

Re: Adding tacacs to NDFC

balaji.bandi — Thu, 18 Sep 2025 17:32:29 GMT

try below step by step (i am using ISE works as expected) - if path is clear no FW in between or allowed and make sure device added to ISE.

https://ndfc-lab.ciscolive.com/lab/pod23/ndfc/rbac

Re: Adding tacacs to NDFC

TroyBolton — Thu, 25 Sep 2025 09:41:40 GMT

1. Just to clarify, "ND nodes are in TACACS devices" you mean are the ND nodes all in ISE which hosts our TACACS server. 2. We know TACACS is approving AAA request because that's the only way to get onto our switches. 3. I believe this is where we are getting lost, AV pair, in ISE i cant seem to be able to add an av pair in policy elements underneath device administration. @bharsch & @balaji.bandi can you confirm what configurations i need to have made in ISE?

Re: Adding tacacs to NDFC

TroyBolton — Thu, 25 Sep 2025 09:43:28 GMT

Hi, there's no firewall in the way atm, I believe I'll need the link you've sent but until I've sorted out the issue with adding the AV pair in ISE I cant implement this yet.

Re: Adding tacacs to NDFC

balaji.bandi — Thu, 25 Sep 2025 14:32:29 GMT

check similar way for AV pair

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/222706-configure-ise-as-an-external-authenticat.html