AAA authentication

[jahasrahman]

Hi 

I have the following commands configured on my switches

aaa new-model
aaa authentication login default group tacacs+ enable
aaa accounting commands 15 default stop-only group tacacs+
aaa session-id common
tacacs-server host 1.1.1.1 key 7 0532091A0C595D1D3B00351D190900
tacacs-server host 2.2.2.2 key 7 0532091A0C595D1D3B00351D190900
tacacs-server directed-request

I need to know when does the TACACS server host failback to the 2.2.2.2 IP. The request goes only to the 1.1.1.1, and if the authentication fails, it won't let you in. Please tell me how the sequence of servers work.

[nspasov · Accepted solution]

Hello Jahas-

The TACACS/AAA servers are processed in a top-down fashion. Thus, the network device in your example will always use 1.1.1.1 unless it becomes unavailable. If the 1.1.1.1 becomes unavailable then the network device will start using 2.2.2.2. 

I hope this helps!

Thank you for rating helpful posts!