tacacs config on ASR 1001

[yanliu2007]

Hi all,

I'm trying to configure Tacacs on Cisco ASR1001, and the Tacacs server is Cisco ACS v3.3, the ACS won't pass the authentication, complaining bad request from NAS, key mismatch - which I compared millions of times on both ASR and ACS sides. below is my config, did I miss anything?

cisco ASR1001, version IOS-XE Software (X86_64_LINUX_IOSD-UNIVERSAL-M), Version 15.1(1)S

aaa new-model

aaa group server tacacs+ TACACS

server-private 192.168.10.20 key 7 xxxx

ip vrf forwarding Mgmt-intf

aaa authentication login default group TACACS local

aaa authorization config-commands

aaa authorization commands 1 default group TACACS if-authenticated

aaa authorization commands 15 default group TACACS if-authenticated

ip tacacs source-interface GigabitEthernet0

[Javier Henderson]

Hello,

Are you using Network Device Groups on your ACS configuration? If so, please check the group settings for a shared secret, if defined it will take precedence over any keys assigned to each individual AAA client contained within that group.

[yanliu2007]

Thanks Javier,

we reset the shared key many times and by reboot the ACS made it work. thank you.