IOS Access Point Bombards TACACS+ Server with Requests

ganeshp — Sun, 04 Jul 2021 17:28:20 GMT

Problem: When using the web GUI to manage an IOS access point such as the AP350, AP1100, or AP1200, and when using TACACS+ to authenticate the HTTP accesses, the access point will send numerous authentication requests to the TACACS+ server for each web page accessed.

Workaround given by cisco was to use single-connection tacacs server.

My question:

How to implement this command? Is it as below

"tacacs-server host x.x.x.x single-connection port 49 key test".

I've tried using this command but still getting numerous authentication request.

Any help?

regards,

Ganesh

Re: IOS Access Point Bombards TACACS+ Server with Requests

gwcrook — Sun, 20 Feb 2005 10:44:38 GMT

We experienced similar problems. We were instructed to use local authentication at the current time. Something about HTTP requiring authentication for each part of the page that accesses data. The configuration line is:

ip http authentication local

The single connection did not help. We were also advised that if we required ACS HTTP authentication to use RADIUS because it scaled better than TACACS and would not be as impacted as TACACS. If neither of these are an option, another workaround is to, disable logging "passed authentications". We tested this and it prevented our ACS server from pegging the cpu, memory and I/O write queues. We opted for local authentication because the lack of "passed authentication" logs impacted our troubleshooting.

Good Luck

Gerry

topic Re: IOS Access Point Bombards TACACS+ Server with Requests in Wireless

IOS Access Point Bombards TACACS+ Server with Requests

Re: IOS Access Point Bombards TACACS+ Server with Requests