%AAA-3-BADSERVERTYPEERROR: Cannot process accounting server type tacacs+ (UNKNOWN)

[RicardoFranca8027]

Estou com varios alarmes de TACACS no meu router, porém não estou achando nunhum erro parecido para o meu problema na internet.

15 de agosto 19: 44: 00.049:% DOMAIN-5-TCA: TCA recebido. Detalhes: ID da instância = 0: VRF = padrão: ID do site de origem = xxxx: ID do site de destino = xxxx: TCA-ID = 177812: TCA-Origem = xxxx (R): saída = [CHAN-ID = 7943, BR-IP = xxxx, DSCP = af21 [18], Interface = Tunnel11, Caminho = INET [label = 0: 11 | 0: 0 [0xB0000]]]: Política violada = navegação: limites (real / config) = [P1 = taxa de perda de bytes (2.16 / 2.0)], [P1 = taxa de perda de bytes (2.16 / 2.0)] , [P1 = taxa de perda de bytes (2,16 / 2,0)], [P1 = taxa de perda de bytes (2,16 / 2,0)], [P1 = taxa de perda de bytes (2,16 / 2,0)], [P1 = byte taxa de juros (2,16 / 2,0)]

15 de agosto 19: 44: 00.049:% DOMAIN-5-TCA: TCA recebido. Detalhes: ID da instância = 0: VRF = padrão: ID do site de origem = xxxx: ID do site de destino = xxxx: TCA-ID = 177812: TCA-Origem = xxxx (R): saída = [CHAN-ID = 7943, BR-IP = xxxx, DSCP = af21 [18], Interface = Tunnel11, Caminho = INET [label = 0: 11 | 0: 0 [0xB0000]]]: Política violada = navegação: limites (real / config) = [P1 = taxa de perda de bytes (2.16 / 2.0)]

15 de agosto 19: 44: 00.050:% DOMAIN-5-TCA: TCA recebido. Detalhes: ID da instância = 0: VRF = padrão: ID do site de origem = xxxx: ID do site de destino = xxxx: TCA-ID = 177812: TCA-Origem = xxxx (R): saída = [CHAN-ID = 7943, BR-IP = xxxx, DSCP = af21 [18], Interface = Tunnel11, Caminho = INET [label = 0: 11 | 0: 0 [0xB0000]]

Aug 15 19: 44: 42.807:% AAA-3-BADSERVERTYPEERROR: Não é possível processar tacacs do tipo de servidor de contabilidade + (DESCONHECIDO)

Estou usando o roteador ISR4221 / K9 versão 16.06.03 Everest 

[marce1000]

 - Make sure you have a TACACS server configured  : 

         https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/aaa_tacacs.pdf

 M.

[RicardoFranca8027]

Yes, I have tacacs set up.

All settings and authentication password have been validated.

[marce1000]

 - Ok. check the TACACS server's logs too when an authentication attempt is done from the switch. Are there any errors observed (e.g.) ?

 M.

[RicardoFranca8027]

Note: We checked the password that is set on the Routers and Tacacs server (ACS) and found that in addition to being correct the connections are being authenticated, however we continue with the session breaks and the message in APIC: ERROR-CONECTION-CLOSED and on routers:% AAA-3-BADSERVERTYPEERROR: Cannot process authentication server type tacacs + (UNKNOWN).

[marce1000]

  - Could be a software bug , if applicable check more recent releases for your platform.

  M.

[MohdHaizarAbdulLatiff4746]

Hi All, need further assistance on how to login my router.

Previously i have perform below configuration to our cisco router ISR 4431 series

!
aaa new-model
!
!
aaa authentication login default group tacacs+ local line enable
aaa authentication login async none
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization exec default group tacacs+ if-authenticated
aaa accounting exec default
action-type start-stop
group tacacs+
!
aaa accounting commands 1 default
action-type stop-only
group tacacs+
!
aaa accounting commands 15 default
action-type start-stop
group tacacs+
!

BUT after my console access to the ended & try to login again, the below error messages occur & I cannot login to the router as I'm not set any username & password previously.

User Access Verification

Username:
*May 26 06:12:59.442 UTC: %AAA-3-BADSERVERTYPEERROR: Cannot process authentication server type tacacs+ (UNKNOWN)

Please help me on how to login access to the router. TQ

[Georg Pauwen]

Hello,

typically, when the TACACS server is reachable but no username is configured, it will not fallback to 'local', and hence will not authenticate. I assume you have checked if the user you are trying to authenticate has been configured on the TACACS server ?

[MohdHaizarAbdulLatiff4746]

Hi Georg Pauwen,

For your question:

"I assume you have checked if the user you are trying to authenticate has been configured on the TACACS server ?"

Answer: No, we have not done any user configuration or authentication on TACACS server.

Currently we cannot access login to the router as we have try username 1)cisco 2)admin & 3)root but unsuccessful.

So we seek help and guide on how to factory reset the Cisco router (ISR 4431 model) & access to ROMMON. 

Thanks.

[MohdHaizarAbdulLatiff4746]

FYI, we currently just try to push the config inside the router & the router is not in production yet.

Please help us on how to factory reset the router.

[MHM Cisco World]

group tacacs+ <<- this no complete config you need to config server and key between Server and SW/R

[MohdHaizarAbdulLatiff4746]

Yes my bad as didn't complete the config for this "you need to config server and key between Server and SW/R"

So I need help on the STEPs or guide - how to factory reset the router ISR 4431 and access to ROMMON.

Please assist. TQ

[MHM Cisco World]

https://www.youtube.com/watch?v=QnBPd3pkjCg

[Flavio Miranda]

Olá Ricardo,

 Tem um bug CSCtr23828 que afeta esse router com comportamento parecido. Dá uma olhada nele. A cisco informa que foi resolvido na sua versão mas não é raro ser documentado como resolvido e ainda ser observado no equipamento