Hi Everyone,   I am testing a DHCP relay in a VRF lite LAB, the goal is to have a central DHCP server to allocate client IP addresses for subnets that are not directly reachable.   To achieve this I am using the helper-address global and ip dhcp relay information options (config below), everything works OK in regards to initial DHCP request and renew, meaning that the DHCP traffic is catch by the VLAN's SVI (in VRF) and forwarded to the DHCP server (in GLOBAL) sourced by the designated source interface. Windows 2016 improves this design because allows the use of option 82 sub option 5 : link-selection   What I am unable to achieve is to forward in the same fashion DHCP release messages that are unicast messages (I have tried this on Windows 7 and Linux).   Is that something I am missing or this is a design limitation of the DHCP relay agent feature ?     version 15.2 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption service compress-config ! hostname CORE ! boot-start-marker boot-end-marker ! ! logging buffered 50000 logging console discriminator EXCESS ! no aaa new-model clock timezone CET 1 0 ! ! ! ! ! vtp mode transparent no ip icmp rate-limit unreachable ! ip vrf A rd 1:1 ! ip dhcp-relay information option server-override ip dhcp relay information option vpn ip dhcp relay information option ! ! no ip domain-lookup ip cef no ipv6 cef ! ! ! spanning-tree mode pvst spanning-tree extend system-id ! ! vlan 8 name VL008_SERVERS ! vlan 128 name VL128_WORKSTATIONS ! vlan 129 name VL129_WORKSTATIONS_VRF_A ! vlan 130 name VL130_WORKSTATIONS_VRF_A ! vlan 253-254 ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address 10.100.1.254 255.255.255.0 ! interface Ethernet0/0 description Win2016_DC switchport access vlan 8 switchport mode access spanning-tree portfast edge ! interface Ethernet0/1 Description ASA switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast network ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet1/0 ! interface Ethernet1/1 ! interface Ethernet1/2 ! interface Ethernet1/3 ! interface Ethernet2/0 ! interface Ethernet2/1 ! interface Ethernet2/2 ! interface Ethernet2/3 ! interface Ethernet3/0 description Lin-1 switchport access vlan 129 switchport mode access spanning-tree portfast edge ! interface Ethernet3/1 description Win-1 switchport access vlan 128 switchport mode access spanning-tree portfast edge ! interface Ethernet3/2 description Win-2 switchport access vlan 129 switchport mode access spanning-tree portfast edge ! interface Ethernet3/3 description Win-3 switchport access vlan 129 switchport mode access spanning-tree portfast edge ! interface Vlan1 no ip address shutdown ! interface Vlan8 ip address 10.100.8.254 255.255.255.0 no ip redirects no ip proxy-arp ! interface Vlan128 ip address 10.100.128.254 255.255.255.0 ip helper-address 10.100.8.1 no ip redirects no ip proxy-arp ! interface Vlan129 ip vrf forwarding A ip dhcp relay information option server-id-override ip dhcp relay information option-insert ip dhcp relay source-interface Loopback0 ip address 10.100.129.254 255.255.255.0 ip helper-address global 10.100.8.1 no ip redirects no ip proxy-arp ! interface Vlan130 ip vrf forwarding A ip dhcp relay information option vpn-id ip dhcp relay source-interface Loopback0 ip address 10.100.130.254 255.255.255.0 ip helper-address global 10.100.8.1 no ip redirects no ip proxy-arp ! interface Vlan253 ip address 10.100.253.254 255.255.255.0 ! interface Vlan254 ip vrf forwarding A ip address 10.100.254.254 255.255.255.0 ! ip forward-protocol nd ! ip tcp synwait-time 5 ip http server ! ip route 0.0.0.0 0.0.0.0 10.100.253.220 ip route vrf A 0.0.0.0 0.0.0.0 10.100.254.220 ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr ! ! access-list 100 permit ip any host 10.100.8.1 ! ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! ! end   ... View more

I am currently configuring an ISE 2.3 policy for TACACS+ to authenticate our devices, one of my goal is to distinguish when login requests comes from ASDM or SSH but I cannot find any meaningful parameter in TACACS+ that could help on this.   On another ISE 2.1 in RADIUS I was able to intercept ASDM requests by a mix of RADIUS AV pairs inbound.   Final goal is to send authentication for ASDM to a specific identity store and authentication from ssh to another identity store.   If I cannot find a solution I will be forced to use RADIUS for ASDM HTTP authentication, that looks not so nice having TACACS.   Thanks in advance! ... View more

Hi, I am testing on lab equipment (2 Catalyst 3550 and 1 Catalyst 3560) HSRP version 1 and 2. I successfully created a load balancing between the two Catalyst 3550 on a couple of vlans (11 and 12) on ver 1 now, just adding the command "standby xx version 2" my hosts on the 2 vlans are completely unable to ping the virtual IP def. gw on debugging i checked that hello msgs are exchanged the two cat 3550 are seeing each other on HSRP (active / standby roles) the real ip addresses are pingable rebooted the swiches (just as a last resort try) deleted arp chache on hosts removed the auth on hsrp all of this no effect... i also tried to modify the priority on the cat 3560 (before he was on both vlans in standby) to make it the active one and with the same config it worked flawlessly... My only idea is that there is a bug on CATs 3550 (IOS: c3550-ipservicesk9-mz.122-55.SE4.bin) configs: SW-3550-A interface Vlan11 ip address 12.0.0.2 255.255.255.0 standby version 2 standby 11 ip 12.0.0.1 standby 11 priority 150 standby 11 preempt standby 11 authentication md5 key-string LAB SW-3550-B interface Vlan11 ip address 12.0.0.3 255.255.255.0 standby version 2 standby 11 ip 12.0.0.1 standby 11 preempt standby 11 authentication md5 key-string LAB SW-3550-A#sh standby Vlan11 - Group 11 (version 2) State is Active 16 state changes, last state change 00:18:08 Virtual IP address is 12.0.0.1 Active virtual MAC address is 0000.0c9f.f00b Local virtual MAC address is 0000.0c9f.f00b (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 2.560 secs Authentication MD5, key-string Preemption enabled Active router is local Standby router is 12.0.0.3, priority 100 (expires in 8.976 sec) Priority 150 (configured 150) Group name is "hsrp-Vl11-11" (default) SW-3550-B#sh standby Vlan11 - Group 11 (version 2) State is Standby 10 state changes, last state change 00:17:18 Virtual IP address is 12.0.0.1 Active virtual MAC address is 0000.0c9f.f00b Local virtual MAC address is 0000.0c9f.f00b (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 2.208 secs Authentication MD5, key-string Preemption enabled Active router is 12.0.0.2, priority 150 (expires in 9.616 sec) MAC address is 000a.8a28.ea80 Standby router is local Priority 100 (default 100) Group name is "hsrp-Vl11-11" (default) Any suggestion is appreciatedd and...thank you all in advance! ... View more

Hi everybody For CCNA security i was testing a lab made of two routers connected by a serial ppp interface and able to reach a Cisco ACS 5.2 AAA Server through a Fast Ethernet 0/0 both. Now my problem is that using RADIUS i am able to authenticate the ppp connection between the routers but i cannot do the same with TACACS+. Thinking about a ACS 5.2 configuration issue i also tryed to manipulate the Service Selection Rules in order to direct TACACS+ authorization to Default Network Access insted of Default Device Admin but with no success. Any help is appreciated, here the routers debug and configs. Thank you all debug ppp authentication (from router-A WITH TACACS+) *Mar  1 02:31:53.295: Se0/0 PPP: Authorization required *Mar  1 02:31:55.299: Se0/0 CHAP: O CHALLENGE id 231 len 29 from "ciscoACS" *Mar  1 02:31:55.327: Se0/0 CHAP: I CHALLENGE id 234 len 30 from "ciscoACS2" *Mar  1 02:31:55.375: Se0/0 CHAP: Using hostname from interface CHAP *Mar  1 02:31:55.375: Se0/0 CHAP: Using password from interface CHAP *Mar  1 02:31:55.379: Se0/0 CHAP: O RESPONSE id 234 len 29 from "ciscoACS" *Mar  1 02:31:55.383: Se0/0 CHAP: I RESPONSE id 231 len 30 from "ciscoACS2" *Mar  1 02:31:55.403: Se0/0 PPP: Sent CHAP LOGIN Request *Mar  1 02:31:55.455: Se0/0 PPP: Received LOGIN Response FAIL *Mar  1 02:31:55.459: Se0/0 CHAP: O FAILURE id 231 len 25 msg is "Authentication failed" ----------------------------------------------------------------------------------------------- debug ppp authentication (from router-B WITH TACACS+) *Mar  1 02:28:53.347: Se0/0 PPP: Authorization required *Mar  1 02:28:53.383: Se0/0 CHAP: O CHALLENGE id 184 len 30 from "ciscoACS2" *Mar  1 02:28:53.391: Se0/0 CHAP: I CHALLENGE id 181 len 29 from "ciscoACS" *Mar  1 02:28:53.455: Se0/0 CHAP: Using hostname from interface CHAP *Mar  1 02:28:53.455: Se0/0 CHAP: Using password from interface CHAP *Mar  1 02:28:53.459: Se0/0 CHAP: O RESPONSE id 181 len 30 from "ciscoACS2" *Mar  1 02:28:53.463: Se0/0 CHAP: I RESPONSE id 184 len 29 from "ciscoACS" *Mar  1 02:28:53.483: Se0/0 PPP: Sent CHAP LOGIN Request *Mar  1 02:28:53.535: Se0/0 PPP: Received LOGIN Response FAIL *Mar  1 02:28:53.543: Se0/0 CHAP: O FAILURE id 184 len 25 msg is "Authentication failed" ----------------------------------------------------------------------------------------------- Router-A configuration (with TACACS+ for PPP -> NOT WORKING) version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router-A ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication ppp ACS_PPP_AUTHENTICATION group tacacs+ aaa authorization network ACS_NET_AUTHORIZATION group tacacs+ ! aaa session-id common ! resource policy ! memory-size iomem 5 ip cef ! ! ! ! ! interface FastEthernet0/0 ip address 172.16.1.3 255.255.255.0 duplex auto speed auto ! interface Serial0/0 ip address 10.0.0.1 255.255.255.254 encapsulation ppp clock rate 2000000 ppp authentication chap ACS_PPP_AUTHENTICATION ppp authorization ACS_NET_AUTHORIZATION ppp chap hostname ciscoACS ppp chap password 0 ciscoACS ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! ! ip http server no ip http secure-server ! ! ! ! tacacs-server host 172.16.1.254 key ciscoACS tacacs-server directed-request radius-server host 172.16.1.254 auth-port 1645 acct-port 1646 key ciscoACS ! control-plane ! ! line con 0 line aux 0 line vty 0 4 ! end ----------------------------------------------------------------------------------------------- Router-B configuration (with TACACS+ for PPP -> NOT WORKING) version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router-B ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication ppp ACS_PPP_AUTHENTICATION group tacacs+ aaa authorization network ACS_NET_AUTHORIZATION group tacacs+ ! aaa session-id common ! resource policy ! memory-size iomem 5 ip cef ! ! ! ! ! interface FastEthernet0/0 ip address 172.16.1.4 255.255.255.0 duplex auto speed auto ! interface Serial0/0 ip address 10.0.0.2 255.255.255.254 encapsulation ppp clock rate 2000000 ppp authentication chap ACS_PPP_AUTHENTICATION ppp authorization ACS_NET_AUTHORIZATION ppp chap hostname ciscoACS2 ppp chap password 0 ciscoACS ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! ip http server no ip http secure-server ! ! ! ! tacacs-server host 172.16.1.254 key ciscoACS tacacs-server directed-request radius-server host 172.16.1.254 auth-port 1645 acct-port 1646 key ciscoACS ! control-plane ! ! line con 0 line aux 0 line vty 0 4 ! ! end ----------------------------------------------------------------------------------------------- Router-A configuration (with RAIDUS for PPP -> WORKING) version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router-A ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication ppp ACS_PPP_AUTHENTICATION group radius aaa authorization network ACS_NET_AUTHORIZATION group radius ! aaa session-id common ! resource policy ! memory-size iomem 5 ip cef ! ! ! ! ! interface FastEthernet0/0 ip address 172.16.1.3 255.255.255.0 duplex auto speed auto ! interface Serial0/0 ip address 10.0.0.1 255.255.255.254 encapsulation ppp clock rate 2000000 ppp authentication chap ACS_PPP_AUTHENTICATION ppp authorization ACS_NET_AUTHORIZATION ppp chap hostname ciscoACS ppp chap password 0 ciscoACS ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! ! ip http server no ip http secure-server ! ! ! ! tacacs-server host 172.16.1.254 key ciscoACS tacacs-server directed-request radius-server host 172.16.1.254 auth-port 1645 acct-port 1646 key ciscoACS ! control-plane ! ! line con 0 line aux 0 line vty 0 4 ! end ----------------------------------------------------------------------------------------------- Router-B configuration (with RADIUS for PPP -> WORKING) version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router-B ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication ppp ACS_PPP_AUTHENTICATION group radius aaa authorization network ACS_NET_AUTHORIZATION group radius ! aaa session-id common ! resource policy ! memory-size iomem 5 ip cef ! ! ! ! ! interface FastEthernet0/0 ip address 172.16.1.4 255.255.255.0 duplex auto speed auto ! interface Serial0/0 ip address 10.0.0.2 255.255.255.254 encapsulation ppp clock rate 2000000 ppp authentication chap ACS_PPP_AUTHENTICATION ppp authorization ACS_NET_AUTHORIZATION ppp chap hostname ciscoACS2 ppp chap password 0 ciscoACS ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! ip http server no ip http secure-server ! ! ! ! tacacs-server host 172.16.1.254 key ciscoACS tacacs-server directed-request radius-server host 172.16.1.254 auth-port 1645 acct-port 1646 key ciscoACS ! control-plane ! ! line con 0 line aux 0 line vty 0 4 ! ! end ----------------------------------------------------------------------------------------------- ... View more