Catalyst 9800-L Seems to Ignore ip tacacs source-interface command

[Tony M]

I have a 9800-L-F currently running 17.3.5b (though this was happening on 17.3.x as well). With either ip tacacs source-interface GigabitEthernet0 or ip tacacs source-interface GigabitEthernet0 vrf Mgmt-intf commands configured, the WLC still uses vlan266 as the tacacs source interface. It's as if the commands weren't configured at all. Other source-interface commands (radius, ssh) work as expected. Is this a known issue?

[MHM Cisco World]

SVI of vlan266 is use as management interface in WLC ?

[Tony M]

No. G0 is management.

[Rasika Nayanajith · Accepted solution]

TACACS over Service Port supported only from 17.6.x onward

As of release 17.6, the following protocols are supported through the Service Port (SP): HTTP/HTTPs, SSH, NetFlow, NTP, SNMP, Syslog, RADIUS, and TACACS+

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html 

HTH
Rasika
*** Pls rate all useful responses ***

[Tony M]

Interesting that it would accept the configuration at all. Even a warning would have been useful.

Thanks for the clarification!

[Rasika Nayanajith]

Hi Tony,

I think there is a quick clarification. With 17.6.x you able to do those protocols using service port.(traffic will in/out via service port)

I think your original requirement is just to simply change the source interface for TACACS & still use the main trunk port connectivity for the communication. However, when you source TACACS traffic from the ServicePort IP address, still all outgoing traffic from 9800 will go via that trunk port, however incoming traffic to the service port IP address may not come via that trunk port (so create bit of asymetric flow)

Therefore better leave it completely via  Trunk port (leave tacacs source as wlc mgt) or completely move it to via serviceport (which requires 17.6.x.)

HTH
Rasika

[Rich R]

There are plenty of commands you'll find which literally have no effect even though you can configure them.  They're left over from the base IOS-XE router code the 9800 was built on top of and they're gradually either adding support for the features or removing them from the CLI in each new release.