AAA TACACS Authentication fails after ASA Failover

[joe@gonetforward.com]

Hello,

I have a pair of ASA(s) running in active/standby. I can fail them over and none of my users remote access VPN connections are effected. My issues with with AAA authentication using TACACS. After the failover I am unable to user TACACS for at least five minutes. I can only get in using the fallback method which is the local database. When doing aaa debugging I get a message that the "Auth-server group NAME unreachable". The thing is I can perform a "test aaa-server authentication NAME" and it successfully authenticates against the same group that it is claiming is unreachable when I try to ssh into it. Anyone every seen this issue?

Thanks for the help,

Joe

[Dennis Mink]

can you share the aaa relevamnt config on the fail over box?  cheers

also do you see the faiiling authentication request in the log of your tacacs server?

[joe@gonetforward.com]

Thanks for following up. Turns out the issue was not having the secondary firewall configured in ISE. See my response for details.

[joe@gonetforward.com · Accepted solution]

Root cause was that the secondary firewall had not been added to ISE. Before the failover events the commands I was running were attempting to run against AAA authorization on ISE but were being rejected as it was not a part of ISE. When the failover occurred the firewall was not even trying to hit ISE as there must be some sort of timer after a failed attempt that prevents it from trying again. Bottom line have both of your firewall in ISE and able to authenticate. This was handy command:

vpn-hk# test aaa-server authentication AAA-SERVER-GROUP

Server IP Address or name: 10.10.10.10

Username: jrenwick

Password: ********

INFO: Attempting Authentication test to IP address <10.10.10.10> (timeout: 12 seconds)

INFO: Authentication Successful

vpn-hk#

Hope this helps somebody someday.

[Dennis Mink]

good to hear mate, mark your answer as solved.