tacacs-server host

[m.iancu]

Hello,

I would like to have more than one tacacs-server host commands in my config.

I'm wondering how the router will parse the server - in a round-robin fashion, it will go to the next server only if the first one is out of service and so on ... so far I haven't found anything in the docs.

Thank you,

Mihai Iancu

[deilert]

no the tacacs server that is listed first will act as you primary , the second server listed in the config will be the backup, If the first server is unavail the router will contact the 2nd sever , after the tacacs-server timeout period expires , I think it is 1 munute by default , I would recommend lowering that parameter.

[Harold Ritter]

That is correct. When you configure multiple TACACS servers, a connection is attempted to the first server (order in which they have been entered) and if it doesn't respond the next one is used.

Hope this helps,

[Craig Norborg]

If you have multiple authentication server groupings you want to use also, you can use "aaa group server" to help organize a bit...

[manojkreddy]

what if the failed primary server comes back online?

will IOS still uses secondary server?

how IOS tests whether the primary server is back online?

or

will it comes back only after the secondary server fails and the primary is available?