CAT 9500-16x Gibraltar 16.12.4 and TACACS+

[JohnRosso3555]

Hello

So I'm able to request NTP through the mgmt-vrf with gig0/0 as the mgmt physical interface:

ntp source GigabitEthernet0/0
ntp server vrf Mgmt-vrf 10.12.17.20
ntp server vrf Mgmt-vrf 10.12.16.61

But it does not seem to allow TACACS or RADIUS through the mgmt-vrf:

DRF312cisco-WWW(config-server-tacacs)#address ipv4 10.12.12.45 ?
<cr> <cr>

DRF312cisco-WWW(config-server-tacacs)#address ipv4 10.12.12.45

No where does it allow me to add it to the Mgmt-vrf like NTP server.

Any thoughts on how to get it to ride on the mgmt-vrf? This is the only port I would like to touch the internal network. All other interfaces would be open to the public facing.

Thank you.

[Seb Rupik · Accepted solution]

Hi there,

The option to specify the VRF can configured under the aaa server-group

!
aaa group server tacacs+ FOO
 server-private 10.12.12.45 key foobar
 ip vrf forwarding mgmt-vrf
 ip tacacs source-interface gi0/0
!

cheers,

Seb.

[JohnRosso3555]

Thanks Seb - not sure how I missed this in the documentation - could I ask what document you saw this in? Was it the System management or Network management.

Much appreciated.

John

[Seb Rupik]

Hi John,

Take a look here:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_tacacs/configuration/xe-16-12/sec-usr-tacacs-xe-16-12-book/sec-vrf-tacas-svrs.html

cheers,

Seb.

[JohnRosso3555]

Thanks Seb - how can we encrypt the password after the word key? If I use type 6 it is invalid. Would be nice to encrypt "foobar". 

aaa group server tacacs+ ClearPass
server-private 10.120.0.85 key 9 foobar
server-private 10.12.16.137 key 9 foobar
ip vrf forwarding Mgmt-vrf
ip tacacs source-interface GigabitEthernet0/0

[paul driver]

@JohnRosso3555 wrote:

 how can we encrypt the password after the word key? If I use type 6 it is invalid. Would be nice to encrypt "foobar".

password encryption aes
key config-key password-encrypt

[JohnRosso3555]

Hi Paul - being that these commands are global level, won't they overwrite the Type 9 passwords I have for local username and also for the enable secret. Currently I have these set:

enable secret 9 "encrypted password right here"

username hphnetadm secret 9 "encrypted password right here"

Thank you

John

[paul driver · Accepted solution]

Hello

No its used to encrypt all  crypto pre-shared keys, However it seems to also perfrom encryption on all other pwd's without applying the "old" service password-encryption feature, So in your case the local username type 9 secret will be the same and so should be the tacacs server key but you should see it apply encryption on your tacacs server type 6 key in the run config