topic Re: WLC TACACS+ fall backfeature in Wireless

WLC TACACS+ fall backfeature

umeshunited — Mon, 05 Jul 2021 15:50:38 GMT

We are using aaa login method list on wlc , for which TACACS will be first and local will be second method.

What should be the tacacs fall back parameter ?

Re: WLC TACACS+ fall backfeature

Flavio Miranda — Wed, 11 Jul 2018 18:35:03 GMT

If I understood you right, fallback means what you want to happen when you server become unavailable:

Off—Disables RADIUS server fallback. This is the default value. Same for TACACS.
Passive—Causes the controller to revert to a server with a lower priority from the available backup servers without using extraneous probe messages. The controller ignores all inactive servers for a time period and retries later when a RADIUS message needs to be sent.
Active—Causes the controller to revert to a server with a lower priority from the available backup servers by using RADIUS probe messages to proactively determine whether a server that has been marked inactive is back online. The controller ignores all inactive servers for all active RADIUS requests. If probing is enabled, the RADIUS server will be probed at every probing time interval irrespective of the probe response having been received or not. For more information, see CSCvc01761.

-If I helped you somehow, please, rate it as useful.-

Re: WLC TACACS+ fall backfeature

umeshunited — Wed, 11 Jul 2018 18:50:28 GMT

Hi Flavio

I have set auth order as mentioned in attached Snap. If tacacs is down , local user database will be used.

Now when tacacs is restored , i want user to be authenticated by tacacs server.

For that tacacs+ fall back parameter has only two value. enable/disable.

What should I choose ?

Re: WLC TACACS+ fall backfeature

Flavio Miranda — Wed, 11 Jul 2018 19:51:54 GMT

I think you are misunderstanding the feature. When you have TACACS and Local this means that if TACACS is not available, you can use local user. If TACACS is available you should use TACACS. This is it, you don't need to setup anything besides that.

Fallback mode is a different thing. This work like a preempt. Let´s say you have two server: A an B.

If server A becomes unavailable, the WLC will send TACACS request to server B.

If Fallback Mode is disabled, when server A come back to life, WLC will continue to send TACACS request to B and A will be a backup server.

If Fallback Mode is Enabled, when server A come back to life, WLC will stop send TACACS request to B and will start send TACACS request to server A.

Hope I was clear.

-If I helped you somehow, please, rate it as useful.-

Re: WLC TACACS+ fall backfeature

umeshunited — Thu, 12 Jul 2018 11:07:23 GMT

Thank you Flavio, I get it now.