Re: Tacacs + VRF Routing problem.

m.papini · ‎06-16-2005

Hi all,

we've configured 4 ggsn instances on our 7613+MWAM cards. On each ggsn we've configured tacacs authentication for login and enable mode access. Each ggsn has to reach the tacacs server with a vrf interface. We currently have a counfiguration like this on our systems:

---------------------------------------

aaa group server tacacs+ GROUP

server-private a.d.d.r key serverkey

ip vrf forwarding VRF-IF

aaa authentication login default group GROUP local

aaa authentication enable default group GROUP enable

ip vrf VRF-IF

rd x:xyz

interface GigabitEthernet0/0.123

description tacacs interface

encapsulation dot1Q 123

ip vrf forwarding VRF-IF

ip address a.d.d.r m.a.s.k

ip tacacs source-interface GigabitEthernet0/0.123

-------------------------------------

The login authentication works well, but with the enable authentication the ggsn can't contact the tacacs server because it chooses a default route through a phisical interface that belongs to another vlan.

We cant' figure out what could be the problem.

Thanks for any help

Massimo

thomas.chen · ‎06-22-2005

You are not able to do enable level TACACS authentication because there is a problem with the configuration. Otherwise the GGSN will be able to reach the TACACS server. Have a look at the following document and check if all the configurations are correct. This document explains the configuration of Per VRF AAA.

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122limit/122b/122b_4/12b_perv.htm#xtocid11

m.papini · ‎06-23-2005

Thanks for your link, but the configuration was ok it seems to be a bug instead:

http://www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCsa40461

Cheers,

Massimo