TACACS not working

[Mokhalil82]

Hi Guys

I have added a 2960x switch to my network and configured with tacacs. It does not seems to talk to the tacacs ACS server and I can ping the server as it also authenticates other devices on the network but this new switch only lets me login with local credentials. I have added the switch to ACS aswell

When i tried "test aaa group tacacs username password" Attempting authentication test to server-group tacacs+ using tacacs+
No authoritative response from any server."

My config on the switch is:

aaa group server tacacs+ ACS1
 server 10.10.10.10
!
aaa authentication login default group ACS1 local
aaa authentication enable default group ACS1 enable
aaa authorization config-commands
aaa authorization exec default group ACS1 if-authenticated
aaa authorization commands 1 default group ACS1 if-authenticated
aaa authorization commands 15 default group ACS1 if-authenticated
aaa accounting update newinfo
aaa accounting commands 1 default start-stop broadcast group ACS1
aaa accounting commands 15 default start-stop broadcast group ACS1

tacacs-server host 10.10.10.10
tacacs-server key 12345678

Thanks

[Reza Sharifi]

Hi,

Here is working config from a 2960-x.

Try just adding these commands and test:

aaa group server tacacs+ ACS1
 server 10.10.10.10
 server-private 10.10.10.10 key 7 ****************
!
aaa authentication login default group ACS1 local
aaa authentication login console group ACS1 local
aaa authentication enable default group ACS1 enable
aaa authorization console
aaa authorization exec default group ACS1 none
aaa authorization commands 1 default group ACS1 if-authenticated
aaa authorization commands 15 default group ACS1 if-authenticated

Also, I don't think you need these commands:

tacacs-server host 10.10.10.10
tacacs-server key 12345678

HTH

[Mokhalil82]

Thanks Reza

After some investigation it seemed the issue is with the tacacs-server host 10.10.10.10 command. I realised upon entering this command the cli accepted it but gave a warning message

"Warning: The cli will be deprecated soon
 'tacacs-server host acs-1 key 0 <my-key>'
 Please move to 'tacacs server <name>' CLI"

Apparently cisco have made a few changes to the config. The tacacs-server ACS1 commands didnt work.

So I entered tacacs-server host 10.10.10.10 key 12345678

That worked.

Thanks

[Reza Sharifi]

Glad it is working.

Thanks,

Reza