TACACS and Python.

[yahya.jaber]

Hi All,

I have a TACACS node that manages 3k devices, recently we developed a python script to do some stuff, whenever that script runs the TACACS CPU goes high and things become slow to access...is there a way to avoid this?

last script was 5 commands in total per device, from the ISE performance page, it should fine to handle 1,200 command/sec.  https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId--621954601

thanks.

[Seb Rupik]

HI there,

Have you tried disabling the accounting during the script run? Once logged in no aaa accounting the relevant lines and then add them back before the script logs out.

cheers,

Seb.

[yahya.jaber]

thank Seb,

i would do that if i have small amount of devices, but i have about 3k-4k devices.
i as thinking of Load balancer for TACACS, i am not sure if that would be a solution.

[Seb Rupik]

OK I see.

I few years back I configured a F5 NLB to load balance a cluster of three PSNs, so it is possible. I followed some instructions from an old Cisco Live slide-deck. I'll see if I can find it...

cheers,

Seb.

[Seb Rupik · Accepted solution]

Not the presentation I read, but newer...turns out this is a popular subject!:
https://ciscolive.cisco.com/on-demand-library/?search.event=ciscoliveus2018&search=ISE#/session/1511296160606001Af1J

https://community.cisco.com/t5/security-documents/ise-load-balancing/ta-p/3648759

cheers,
Seb.

[yahya.jaber]

thanks a lot Seb.

[Seb Rupik]

Probably worth a read too:
https://community.cisco.com/t5/security-blogs/how-to-tacacs-failover-with-f5-big-ip-virtual-servers/ba-p/3796384