IOS-XE: Testing specific TACACS server

[Martin W Joergensen]

I have a WS-C3650 running IOS-XE version 03.06.06E.

I have two tacacs+ servers configured on it and I can login fine.

I know that the primary tacacs server, server1, is working, but how can I test that server2 is working as well?

When I issue the command below it tests against server1 every single time.

test aaa group tacacs+ [username] [password] legacy

What command can I use to test against server2?

I tried checking "show tacacs" and it confirms that all requests are sent to the primary tacacs server.

Is there any way to configure IOS-XE to use round-robin for the two available tacacs servers?

[Mark Malone]

Could you not temporarily remove the primary server ip from the AAA , that will force it to use the standby to make sure its working in test
or you could test its open using telnet and port 49 , i haven't seen a round robin test command before in any of the docs or cli

telnet x.x.x.x 49

[Martin W Joergensen]

---

@Mark Malone wrote:
Could you not temporarily remove the primary server ip from the AAA , that will force it to use the standby to make sure its working in test

---

Unfortunately this is not an option as the device is under strict change control. I can't make any changes to the configuration of the device without an approved change request.

---

@Mark Malone wrote:
or you could test its open using telnet and port 49 , i haven't seen a round robin test command before in any of the docs or cli

telnet x.x.x.x 49

---

One of the things I wanted to test is if the TACACS key is correctly specified on both the device and on the TACACS server. Unfortunately a telnet test is not enough to verify the TACACS key.

[Mark Malone]

Looks like you can do it on ios but not ios-xe so you may need a window to fully test those platforms, other option is stop primary service on ACS let secondary takeover but thats n more risky than removing line from AA config in cli 

from 3560v2

#test aaa group xtacas server ?
  Hostname or A.B.C.D  IP address of server to test

[Richard Burts · Accepted solution]

I had a requirement that was similar to this (not quite the same but close). We had two tacacs servers and wanted to be able to test with the backup. The solution that I used was that I configured a second tacacs group which had only the backup server assigned to it. I then configured a second aaa authentication login command and used a name for it so we had aaa authentication login default and had aaa authentication login testserver. Then on the last vty line I used login authentication testserver so that only connections to the last vty would authenticate with the backup server. Our standard config for vty specified transport input ssh and I modified the config of the last vty to transport input ssh telnet. So when I wanted to test I would simply telnet to the device, I would connect to the last vty, and would be able to test the backup server. This was on an IOS device (I did say similar but not quite the same as this post) but I assume IOS-XE would support this functionality.

HTH

Rick

[Martin W Joergensen]

This is not the best solution, but it works.

My solution will be to create a second group only with the backup server and then use the test command to test that group.
I hope Cisco will add the ability to test a single TACACS+ server in IOS-XE in the future

[Mark Malone]

You can request a feature enhancement through your Cisco account manager if you have one i did it for MPP eventually got it fully integrated to ios-xe just took about a year though and a lot of pushing

[Richard Burts]

I am glad that you find that my suggestion is a workable solution if not the preferred solution. Thank you for marking the question as solved. I agree that having the software support specific server in the test command is the optimum solution. The suggestion from Mark that you can make a request for a feature enhancement is the way to go.

HTH

Rick

[Fraydoon Razazi]

use the command:

test aaa group [ AAA Server group name] server [IP address of server to test] [username] [password] legacy