It's always handy to perform a sanity check before issuing the IOS commands
- Ensure that the devices exist in the AAA server (ISE or whatever) and that the IP address in the AAA matches that which is in your IOS config source interface.
- Ensure that the TACACS+ shared secret in the IOS is identical to the one in the AAA server
- Check each IOS device's source interface - if you are 100% it's always the same VLAN or loopback then well done - but I never trust that assumption - I come across devices that have mysterious/ancient configs that never got standardised!
- Check each IOS device's TACACS+ config in case there device uses a VRF - ensure that the VRF (if used) is mentioned in the TACACS+ config.
Once that is done and confirmed, then you can proceed to configure a device. As @johnd2310 mentioned, you can issue a "reload in 10" for extra belts and braces. However, I never do that in practice (I used to). What I do now is a little more sophisticated.
ssh to the device
enter the commands up to (but not including) the aaa commands
aaa new-model
aaa group server tacacs+ AAA01
server-private key
server xxxxx
ip tacacs source-interface Vlan17
end
and then test the comms to the AAA server
test aaa group AAA01 testusername testpassword new-code
You can replace the testusername and testpassword with real credentials. if you use dummy credentials then the expected response on the CLI should be
Sending password
User rejected
else you'll see something like this
Sending password
User successfully authenticated
USER ATTRIBUTES
username "johnf"
reply-message "Enter password:"
At this point you're 100% sure you're talking to the AAA server.
What happens next is crucial.
When you enter the aaa commands, you'll hit a roadblock when you enter the aaa authorization. Because, how the IOS is talking to the AAA server and will request authorization. At this point, simply log into the same device again, and then paste all the aaa commands again, starting from the aaa accounting .... statements
If you get locked out for whatever reason, don't panic. Go into the AAA server (e.g. ISE) and untick the TACACS+ box for that device. That will cause the IOS to get no response from AAA, and hence, fallback to local auth (as the case in your statement aaa authentication login NETLOGIN group AAA01 local )
