TLS 1.3 for tacacs and http service

[ammahend]

testing tls1.3 for http and tacacs services on 9300-48U with 17.15.3

http is fine but I don't see tls option under tacacs server config

switch(config-server-tacacs)#t?
timeout

any advice is appreciated, I have my root and signed certificate associated with trustpoint, but not able to map the trustpoint with tacacs service. 

for http, I have no issues

switch(config-server-tacacs)#do sh run | sec http
ip http tls-version TLSv1.3
ip http secure-trustpoint my-switch-trustpoint

[pieterh]

why look on the tacacs+ client / switch? -> set minimum version on the TACACS+ server to TLS1.3

[ammahend]

server side is configured already, client side config below is what I am not able to configure 

https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/225097-configure-tacacs-over-tls-1-3-on-an.html#toc-hId-93095770

[Mark Elsen]

  - @ammahend          If the server offers TLS 1.3 only  , then the client can do nothing else

  M.

[pieterh]

the http tls-version command and certificate is for incoming requests to the web-interface of the device
this configures the web-management interface to use TLSV1.3
and has nothing to do with outgoing connection to the TACACS+ server.
-> you must do similar configuration on the TACACS+ server itself

[ammahend]

Please see my question and link I shared, I already said https is working fine. 

my question was about associating trustpoint with tacacs server but I don’t see any tls command under tacacs server config (like shown in the url I shared), suppose to be supported from 17.15.x 

[rschlayer]

@ammahend You should have these commands available, indeed from 17.15.X:

Step 1. Create TACACSS server and AAA groups, associate the client (router) trustpoint.

tacacs server svs_tacacs
 address ipv4 10.225.253.209
 single-connection
 tls port 6049
 tls idle-timeout 60
 tls connection-timeout 60
 tls trustpoint client svs_cat9k
 tls ip tacacs source-interface GigabitEthernet0/0
 tls ip vrf forwarding Mgmt-vrf
!
aaa group server tacacs+ svs_tls
 server name svs_tacacs
 ip vrf forwarding Mgmt-vrf
!
tacacs-server directed-request

Taken from here: https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/225097-configure-tacacs-over-tls-1-3-on-an.html#toc-hId-1369066302