Nexus 7010 AAA Issues/Questions

[dtran]

Hi all !!! Hope everyone is doing well !!

I am working on configuring a pair of Nexus 7010, this is a new install. I've got the switches connected to the network via the Mgmt0 interface and this is the only connection that I can get to them for the time being. AAA is configured and working but for some reason when I try to SSH to either one there is a delay about 30 seconds for the password prompt to come up. So after I type in the username it takes about 30 seconds for the password prompt to come up. The delay occurs after I added the SVI's on the 7010 but prior to that there was no delay. Has anyone seen this issue ? I have no idea why adding the SVI's would cause this delay.

Thanks in advance for any inputs/suggestions !!!

D.

[Jerry Ye]

Did you specified tacacs to use the management VRF?

Regards,

jerry

[dtran]

Hi Jeye !! Below is what I've configured on the 7010. I notice the delay after I added the SVI's and if I shutdown all the SVI's then there is no delay. Thanks !!! I appreciate your response !!!!!!

ip tacacs source-interface mgmt0

tacacs-server timeout 3

tacacs-server host 172.16.9.161

aaa group server tacacs+ tacacs

    server 172.16.9.161

    use-vrf management

[Jerry Ye]

What version are you running? Also, do you have ip domain-lookup enabled?

Regards,

jerry

[dtran]

Hi Jerry !!! Really appreciate your help !!!!!

I am running 5.2.1 and yes, ip domain-lookup is enabled.

Thanks !!!

D.

[Jerry Ye · Accepted solution]

Not a problem.

I think I know the issue. Do a no ip domain-lookup and let me know the test result.

Regards,

jerry

[dtran]

That did it Jerry !!! very much appreciate your help !!!!!

"no ip domain-lookup" fixed it. Could you explain why that happens with SVI enabled ?

Thanks Jerry !!!!

D.

[Jerry Ye]

When you telnet or ssh into the N7K, the Nexus7000 actually performs reverse DNS lookup (which is required by SSH server daemons) for the PC's IP address. This causes almost 40 seconds before the user gets prompt.

There is an enhancement bug filed against this

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtj78989

The current workaround is no ip domain-lookup.

HTH,

jerry