AAA not encrypting

[ateeqs.net]

Hi All,

i am adding the device into ACS, but the tacacs server host xx xx xx key 0 xx xx xx is not getting encrypted and my device is not communicating with tacacs+, Please some on help me.

When i do show running, there i can see the key which we have given is not encrypted becuase of this device not communciating with tacacs.

Waiting for your valuable input. thanks in advance.

A

[ateeqs.net]

One thing i want to add here i am using ios version 12.1(19)EW1.

[lgijssel]

Using the leading 0 before the key only causes it to stay in the config as clear text.

This is not affecting the operation of tacacs as long as the key -and everything else- is correctly configured.

Please check your aaa config lines, eventually compare them with another box that is already working.

Probably there is a type somewhere.

regards,

Leo

[ateeqs.net]

Hi,

Thanks for your response,

I checked the configuration but didnt find any missing, only can see is the ios difference,

12.1(14r)EA1 (Not working)

Version 12.2(25r)SEB ( working)

Any input would be great appreciated.

Thank you very much.

[cadet alain]

Hi,

So the communication with ACS is failing? Can you do a debug aaa authentication and post result here.

Regards.

Alain.

[ateeqs.net]

Swich1#debug aaa authentication

AAA Authentication debugging is on

Swich1#

After debug i dont see any logs

[cadet alain]

Hi,

Can you post output of show log command ? How are you connected? console or remote because if remote you have issue terminal monitor command to see debugs.

Regards.

Alain.

[Antonio Knox]

When i do show running, there i can see the key which we have given is not encrypted becuase of this device not communciating with tacacs.

If seeing a non-encrypted password in your running configuration is your issue here, then issue a

Switch1(config)# service password-encryption

That should encrypt the password in your running config.

[Richard Burts]

A

Your original post seems to believe that the TACACS server key not being encrypted is due to (or perhaps is causing) your router not working with the server. This is not the case. Whether the server key is encrypted or not depends on whether you have configured service password-encryption and on what version of code you are running. In earlier versions of IOS the server key is always in the clear and in more recent versions the key may be encrypted.

If the router is not working with TACACS then the output of show TACACS might be helpful. Also you might try something on the router that should use TACACS and then look in the logs of the server and see if there is an error message that could help identify the problem.

HTH

Rick

Sent from Cisco Technical Support iPhone App

[Kelvin Willacey]

Have you checked the reports/logs in ACS? It should give you a very good idea of what the problem is, I would focus there first.