aaa authentication tacacs authentication intermittent work for cisco switch

[Pawan Raut]

aaa authentication tacacs authentication intermittent work for cisco switch. When we capture log on ISE we dont get any logs when aaa tacacs authentication get failed.

Model Number : WS-C3850-48P

Cisco IOS Software, IOS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.02.03.SE RELEASE SOFTWARE (fc2)

Switch aaa configuration as below

aaa group server tacacs+
server-private <ISE1> timeout 2 key <Password>
server-private <ISE2> timeout 2 key <Password>
server-private <ISE3> timeout 2 key <Password>
server-private <ISE4> timeout 2 key <Password>
ip tacacs source-interface Loopback0
aaa authentication login default group ISE-Group local
aaa authentication login console local
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group ISE-Group local if-authenticated
aaa authorization exec console local if-authenticated
aaa authorization commands 1 default group ISE-Group local if-authenticated
aaa authorization commands 2 default local if-authenticated
aaa authorization commands 15 default group ISE-Group local if-authenticated
aaa accounting commands 1 default start-stop group ISE-Group
aaa accounting commands 1 console start-stop group ISE-Group
aaa accounting commands 2 default start-stop group ISE-Group
aaa accounting commands 15 default start-stop group ISE-Group
aaa accounting commands 15 console start-stop group ISE-Group
aaa session-id common

Any lead will help

[Aravind Ravichandran · Accepted solution]

Hi,

From the configuration i can see aaa group server tacacs+ ISE-Group is missing.

Please refer this document & cross check the configuration

https://community.cisco.com/t5/security-documents/how-to-ise-tacacs-configuration-for-ios-network-devices/ta-p/3631080

[Pawan Raut]

that was copy paste error but its not missed in actual device configuration.

[paul]

If you have a large volume of TACACS transactions happening you may be timing out periodically due to the large number of TCP connections.  This has happened to me before.  Enable single connect mode on all your TACACS devices and see if that helps.  You also need to enable legacy single connect under the network devices in ISE as well.