cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2646
Views
5
Helpful
7
Replies

ISE 2.7 Patch 2 on VM: TACACS broken?

gaigl
Level 3
Level 3

Hello,

 

we've got a ISE Test-Device on VM and a Deployment on Hardware.

When I install Patch 2 on the virtual machine, TACACS is broken, I get a " 13078 Invalid TACACS+ authorization request packet - possibly malformed packet"

 

rolling back Patch 2, everything is fine again.

 

The same Patch on the Hardware-Deployment is working fine.

 

Has anyone installed the Patch on a VM and is running TACACS Policy?

 

Radius is fine

7 Replies 7

Arne Bier
VIP
VIP

I had a horrid experience with 2.7 p1 and I eventually killed it off in favour of the old ISE 2.4 - but thanks for your valuable feedback - if you could open a TAC case to get confirmation of a bug, then it would be very helpful in avoiding this patch. If it is a bug then Cisco ought to reconsider making this a golden/recommended release. There is no reason for TACACS to stop working so late in the game.

Dinesh Moudgil
Cisco Employee
Cisco Employee

Hello @gaigl

I have tested device admin with ISE VM 2.7 on a 3750 switch and it works even after upgrading ISE to patch 2.

 

Were you able to gather packet capture from ISE during the time of the issue ?

 

If yes, what do you see when you decrypt Tacacs+ packet exchange in wireshark by entering the shared secret?

 

Thanks,

Dinesh Moudgil

 

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

no I didn't take a capture, when I saw the error, I instantly rolled back.

But maybe I try the patch once again.

thanks for your test

Please do take packet captures and debugs on both ISE and switch or perhaps open a TAC case if you can, to investigate further.

 

Thanks,

Dinesh Moudgil

 

 

 

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

Marvin Rhoads
Hall of Fame
Hall of Fame

I have ISE 2.7 Patch 2 (single node VM deployment) in my lab with TACACS (Device Admin role) and it is working fine.

ISE 2.7 P2 TACACS Live LogISE 2.7 P2 TACACS Live Log

I've tried patch-install a decond time: now it's ok.

strange but ok

thanks guys

I see your Tacacs Live logs are working?  I cant get mine working, not sure what's happening.  I am same version and patch as yourself.

Tacacs reports are fine.