Cisco Catalyst 9500 does not accept TACACS+ configuration

[lnw-team]

Hello, 

we are currently in the process of migrating to the new Cisco ISE appliance. As part of the process, we change TACACS+ configuration on all our devices. During migration we’ve encountered problem with our Cisco Catalyst C9500 core switch, which does not save new TACACS+ configuration. Although the commands are executed correctly, they are not part of running configuration (TACACS+ server group). For the time being, the only way to access device is with local credentials. Authentication against TACACS+ server (Cisco ISE) does not work. 

When we try to add the following commands, they are executed but they are not part of running configuration. 

aaa group server tacacs+ TACACS
server name AAAAA
server name BBBBB
server name CCCCC
server name DDDDD

All servers are configured and are part of a running/startup configuration. 

[marce1000]

 - Review the complete setup according to https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/16-11/configuration_guide/sec/b_1611_sec_9500_cg/configuring_tacacs_.html
    Check logs  on the 9500 after commands entered  (look for errors , if any)

 M.

[balaji.bandi]

what is the IOS XE code running here ? 

I use below commands all the time for IOS XE device and works as expected : (May be try different name than TACACS - see that make any difference - not that i expect that is wrong in case).

aaa new-model

tacacs server ISENODE1
address ipv4 10.10.10.10
key xxxxxx

tacacs server ISENODE2
address ipv4 20.20.20.20
key yyyyyy

aaa group server tacacs+ ISENODEGROUP
server name ISENODE1
server name ISENODE2

[DanielP211]

Hello!

I belive you havent defined the server name AAAAA tacacs server?

You have to configure first for all servers:

tacacs server AAAAA
address ipv4 X.X.X.X
key xyz

BR

[lnw-team]

They are definied. 

[balaji.bandi]

if you are defined, can you post show run | in tacacs or show run all | in tacacs ( also asked before what is IOS XE code running in the Cat 9500 ?)