Cisco ISE do not see any TACACS hit !!!

[Beacon Bits]

Hello everyone,

I have cisco switch authenticating to Cisco ISE fine with the below commands.

Switch Config

-------------

aaa authentication login default group tacplus-server local line

aaa group server tacacs+ tacplus-server
server 10.10.200.200

Scenario

---------

I built a new ISE vm and pointing my switch to new ISE(10.10.200.205)

Problem

--------

new ISE do not see any log or any policy hit whereas it has same configuration as the exisiting one (10.10.200.200).

I did debug on the switch and seeing a message "FAIL - password incorrect"

00:48:06: AAA/AUTHEN/LINE(00000004): GET_PASSWORD
00:48:14: AAA/AUTHEN/LINE(00000004): FAIL - password incorrect
00:48:16: AAA/AUTHEN/LOGIN (00000004): Pick method list 'default'
00:48:16: AAA/AUTHEN/LINE(00000004): GET_PASSWORD

00:48:17: AAA/AUTHEN/LINE(00000004): FAIL - password incorrect

Can anyone help??

Regards,

B

[paul]

Did you enabled the Device Admin service in ISE and configure the appropriate rules?  Did you enable the TACACS shared secret on the network device in ISE?  What do you see in the TACACS Live Logs?  I am guessing nothing.

[Arne Bier]

further to what  @paul  said, you are missing a few IOS commands - typically the source interface has to be specified in the tacacs server config or else the IP source IP address gets used by whichever interface the NAS uses to send the TCP packet - you need to make it deterministic.

I would follow the Prescriptive Guide - excellent document - step by step

https://community.cisco.com/t5/security-documents/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365

[Beacon Bits]

Hi @paul / @Arne Bier 

Switch config is fine as I did not paste the whole config and Production ISE config fine too.

The new ISE has a backup config uploaded as the production ISE.

So on the switch, I just pointed towards the new ISE.

In doing so, I don't see any hit from the switch and this is not the first time I'm doing this scenario.

Not sure, what I'm missing!

Thanks!

[Arne Bier]

Hi @Beacon Bits  - I would suggest that you share parts of the show run so that we can verify the switch config.

Have you tried any debug commands to see whether the switch tries to contact the correct IP (ISE node) ?