Device Tacacs authentication failure

[BigK]

On ISE 2.4 I see Tacacs authentication failure for 2 devices. This is under –-> work centers -->device administration -->reports --> Device administration report --->Top N Authentication by failure reason. The failure has to do with the username, where can I check the username to make sure this device does have the correct username. 

TACACS Authentication

Failure Reason: 13030 TACACS+ authentication request missing a User name Status: Fail From 2019-05-28 00:00:00.0 to 2019-05-28 07:35:04.0 Generated At: 2019-05-28 07:35:05.05

[yalbikaw · Accepted solution]

Hello, 

please collect tcp dump from operations diagnostic tools.

then try to do this authentication, once you are done stop and download the pcap.

open using wireshark, the payload will be encrypted so you need to inside wireshark to preferences> protocols and search for tacacs+

put the shared secret there and then you will be able to check the packets and verify what is missing,

Wishes,