TACACS compatibility with VRF lite

[hinkle]

We have command authorization using TACACS currently deployed network wide. We are begining to deploy routers using VRF lite and within 6 months will deploy full MPLS over a metro-wide fiber network. TACACS is currently not supported using VRF instances and Radius does not support command authorization. My questions is what does Cisco recommend as an alternative? Does anyone else have a similar situation and/or solution?

Thanks in advance........

[Harold Ritter]

It seems like TACACS+ per VRF is what you are looking for.

Hope this helps,

[hinkle]

Your right, that is the most logical answer: however, in our test environment, the IP VRF command is not present when we configure TACACS+. The following is our testing setup:

2651 runing IOS version 12.2.15ZJ5

1 frame circuit with 2 PVCs

2 FastEthernet interfaces

2 vrf instances, each with one PVC and 1 FastE

aaa group server radius radius1

server-private 10.x.x.x (etc)

ip vrf forwarding inside<<<<<<<<<<<<<<<<<<<<<<<<

ip radius source-interface Loopback0

The same "aaa group" command using TACACS does not include the "ip vrf forwarding" statement.(***see below***)

***************************************************

rel2651(config-sg-tacacs+)#?

TACACS+ Server-group commands:

default Set a command to its defaults

exit Exit from TACACS+ server-group confguration mode

no Negate a command or set its defaults

server Specify a TACACS server

rel2651(config-sg-tacacs+)#

**************************************************

Is this an IOS specific issue?

Glenn

[andy.waldwyn]

Hi,

I think 12.3.7T will get you out of jail. This includes ip vrf forwarding within a tacacs group.

Hope this helps

Andy

[hinkle]

Thanks Andy,

I'll check it out. Our local Cisco rep was little help on this issue, maybe it has never come up before.

[danne]

Do you know if this also works with a Cat 3550 which we run VRF lite in - is there a SW that will enable this support ?

[hinkle]

Danne,

I searched the feature navigator ( cisco.com/go/fn ) and there are only 3 IOS versions listed, none of which show support for the 3550. I wanted to use a 2651xm and it is not supported by one of these either. I needed the command level authorization TACACS gave me but it seems that Radius is the only AAA method Cisco is supporting when using VRF lite.

Some other gotcha's include DLSW and TFTP (Gee,wonder what we use that for???)

Luck to you,