Router AAA VRF

[johnlloyd_13]

hi,

i got a router which has AAA and MGMT interface using a VRF.

i noticed some routers has MGMT VRF configured but not under its AAA 'ip vrf forwarding'

i need to add the said command under AAA to generate/monitor logs in ISE.

my question is, will i get cutoff or lock out if i add the said command? and i'm able to ping though the ISE IP address via the MGMT VRF.

router#sh run | s aaa
aaa new-model
aaa group server tacacs+ SERVER1
 server 10.10.10.1
 ip vrf forwarding MGMT

[barweiss45]

I think you should be good expect I would add the source interface command to that aaa group. For example:

aaa group server tacacs+ SERVER1
 server-private <SERVER INFORMATION> key <TACACS KEY>
 ip vrf forwarding MGMT
 ip tacacs source-interface <INTERFACE YOU ARE USING FOR MGMT THAT IS ON THE MGMT VRF>
end

However, I would test on a lab device. Be sure that you validate that tacacs is working. You should see increments for received and transmitted packets to the tacacs server by running the "show tacacs" command. When I am doing anything like this 1)I use my configuration rollback settings (config term revert timer idle <minutes>) 2) never logged out of the my first session until tacacs is confirmed. 3) log into a new session to test tacacs. 4) use the "show tacacs" command.

HTH,

Barry