TACACS socket errors

[Rojer-bkk]

Hi Expert,

I have two switches, one of switch has problem when I issue TACACS configuration. I have two servers and be able to ping success to the server. I'm doubt when i read description in Cisco docs. Please help to identify the cause. Thanks and appreciate for help.

switch02#test aaa group tacacs+ btela77 Aug2011b legacy

% Authorization failed.

I issue show tacacs found socket error:

switcho02#show tacacs

Tacacs+ Server     : 10.52.0.158/49

Socket opens:      4

Socket closes:     4

Socket aborts:     0

Socket errors:      4

Socket timeout:    0

Failed Connect Attempts:     0

Total Packets Sent:              4

Total Packets Recv:              4

Tacacs+ Server     : 10.51.65.94/49

Socket opens:      3

Socket closes:     3

Socket aborts:     0

Socket errors:      0

Socket timeout:    0

Failed Connect Attempts:     0

Total Packets Sent:               0

Total Packets Recv:              0

[smitesh kharecha]

Hi Rojer,

In you output, I couldn't see any socket errors or timeouts.

Can you please explain, the issue.

Regards,

Smitesh

[Rojer-bkk]

Hi Smitesh,

Thanks for reply. You can see the output about socket errors

switcho02#show tacacs

Tacacs+ Server     : 10.52.0.158/49

Socket opens:      4

Socket closes:     4

Socket aborts:     0

Socket errors:      4

Everything is fine if I try to use same test with same username and TACACS server on other switch (please see in attach)

[smitesh kharecha]

Are you able to ping server from switch ??

Regards,

Smitesh

[Rojer-bkk]

yes. I'm able to ping server from switch.

[Richard Burts]

I find it interesting and probably significant in the original post that the error is authorization failed and not that authentication failed.

switch02#test aaa group tacacs+ btela77 Aug2011b legacy

% Authorization failed.

If the TACACS server got to authorization then it implies that it authenticated ok and then had a problem with authorization.

My first guess is that there is some config difference between the switch that does work and the switch tat does not work. Can you post the AAA configuration of both switches?

If it is not a config difference in the switches then my second guess is that there is some difference on the TACACS server about how the 2 switches are configured. Can you check the TACACS server configuration for both switches?

HTH

Rick

[Rojer-bkk]

Hi Rick,

Thanks for your idea. I need to separate the issue between switch and server so i prove switch first. About configuration, no different after compared. I uploaded the both switches configuration please help to verify once again. BTW, can you advice me about debug command that could help to clarify more about issue. I knew about debug 3 cmds

debug aaa authentication

debug aaa authorization

debug tacacs

[Richard Burts]

I have looked at the configs that you posted and I do not see any config difference that would explain this symptom.

Can you check the TACACS server and verify its configuration of both switches is the same?

The switch name in your original post is different from the switch names in either of the config files that you posted. Can you explain this difference?

Are you sure that it was exactly the same user name that you used in testing on both switches?

HTH

Rick

[Rojer-bkk]

Yes i use the same username for testing on both switches. You can see the different output from both switches if you show tacacs. The socket error shown when i test aaa on issue switch but not see on the other switch

[Rojer-bkk]

Hi Rick,

The output from debug shown as below

Oct 20 06:26:16.889 GMT: TAC+: decrypt: pak is unencrypted but we have a key

Oct 20 06:26:16.889 GMT: TPLUS(0000005B): Decryption failed for AAA request

Oct 20 06:26:16.889 GMT: TPLUS(0000005B)/0/5F9E820: Processing the reply packet

Oct 20 06:26:16.889 GMT: TPLUS: Received Authen status error

Oct 20 06:26:16.897 GMT: TPLUS(0000005B)/0/REQ_WAIT/5F9E820: timed out

Oct 20 06:26:22.350 GMT: TPLUS(0000005B)/0/READ: read entire 18 bytes response

Oct 20 06:26:22.350 GMT: TAC+: decrypt: pak is unencrypted but we have a key

Oct 20 06:26:22.350 GMT: TPLUS(0000005B): Decryption failed for AAA request

Oct 20 06:26:22.350 GMT: TPLUS(0000005B)/0/5AAF32C: Processing the reply packet

Oct 20 06:26:22.350 GMT: TPLUS: received authorization response for 91: FAIL

Oct 20 06:26:22.350 GMT: AAA/AUTHOR/EXEC(0000005B): Authorization FAILED

The cause of error could be share-key mismatch between switch and TACACS server?

Full debug output in attach. Thanks

[Richard Burts · Accepted solution]

Can you try again from the switch with a problem and then check on the TACACS server and see if the server has anything in its failed attempts log about this?

HTH

Rick

[Rojer-bkk]

Incorrect configuration on TACACS. Thanks for help

[Richard Burts]

I am glad that my suggestions pointed you toward the solution. I am glad that you got it worked out. Thank you for using the rating system to mark this question as answered (and thanks for the points). It makes the forum more useful when people can read about an issue and can know that a solution was found. Your marking has contributed to this process.

HTH

Rick

[hugo.salomao]

Thnaks for help its works

In my case it solve the problem
1st delite the older config

no tacacs-server directed-request
no tacacs-server host 10.x.x.x.

no tacacs-server key 7 071B....

2nd:
aaa group server tacacs+ TAC+
server name Servidor

tacacs server Servidor
key 7 105A1B...
address ipv4 10.X.X.X

[jaydoer1]

commands worked for ASR1001x which stuck on TACACS authentication. Thanks