The purpose of TACACS source interface

[goosamsf]

Hi,

I wonder how exactly the soucrce-interface play the role in processing tacacs authentication in Cisco Networking device.

For example , I curently use 9300 and I put the tacacs source interface that is currently being shutdown by admin, Yet user can authenticate through tacacs.

would you be able to explain how this works? 

[Royalty · Accepted solution]

Hi @goosamsf,

You can apply the 'ip tacacs source-interface' command inside the AAA server-group configuration or globally, for example:

Server-group:

aaa group server tacacs+ tacacs-server-group
    server-private 10.255.255.255 
    ip tacacs source-interface Loopback80

Global:

configure terminal
ip tacacs source-interface Loopback80

If specified within the server-group, it will take precedence over the global command FOR that particular server-group (you may have multiple server-groups configured).

If the interface specified within the 'ip tacacs source-interface' is down or does not have an IP address assigned, the device will use the outgoing interface chosen by the routing table for the destination. For example, if the TACACS server's IP address is 10.255.255.255 and the outgoing interface (associated with the next-hop) to reach 10.255.255.255 is via GigabitEthernet0/0/0, it will use the IP address assigned to GigabitEthernet0/0/0.

So, there are cases where not specifying the source interface will work, because the default interface that is chosen may have an IP address that is reachable and authorised by the TACACS server.

[goosamsf]

@Royalty  Thanks, 

Very clear, and really helped me understand this.

[Marvin Rhoads]

I would add to the excellent explanation provided by @Royalty that you may need to take into account the vrf keyword if you use a source interface that is not in the default vrf. For instance, many switches have an "out of band" management interface in the Mgmt-vrf.