Cisco IOS-XE TACACS+ priority and load balance

[bakaholic39]

Hello!

I am curious if I'm configuring TACACS like this

tacacs-server host 192.168.10.11
tacacs-server host 192.168.10.12

Will it be load balanced?
Will it prioritize in order?

Thanks!

[balaji.bandi]

tacacs-server host 192.168.10.11
tacacs-server host 192.168.10.12

Will it prioritize in order?  - this is first one order, if that fails then second.

If you like to LB, then you need to use LoadBalancer.

[Reza Sharifi]

Hi,

Priority based. It will try .11, if not available, it will try .12

HTH

[M02@rt37 · Accepted solution]

Hello @bakaholic39 

TACACS+ configuration on most devices does not inherently support load balancing in the sense of distributing requests evenly across multiple servers. The typical behavior is failover, not load balancing. Thus, the second server acts as a backup rather than sharing the load with the first server.

[johnlloyd_13]

hi,

just be mindful, in 'newer' IOS-XE these commands are no longer supported.

these are now configured under 'aaa group server'

aaa new-model
aaa group server tacacs+ <TACACS GROUP NAME>
 server-private <TACACS HOST IP 1> key <TACACS KEY>
 server-private <TACACS HOST IP 2> key <TACACS KEY>

[MHM Cisco World]

if you use ISE then you can easily load balance 
 https://community.cisco.com/t5/security-blogs/how-to-tacacs-failover-with-f5-big-ip-virtual-servers/ba-p/3796384

MHM