IOS Access Point Bombards TACACS+ Server with Requests

[ganeshp]

Problem: When using the web GUI to manage an IOS access point such as the AP350, AP1100, or AP1200, and when using TACACS+ to authenticate the HTTP accesses, the access point will send numerous authentication requests to the TACACS+ server for each web page accessed.

Workaround given by cisco was to use single-connection tacacs server.

My question:

How to implement this command? Is it as below

"tacacs-server host x.x.x.x single-connection port 49 key test".

I've tried using this command but still getting numerous authentication request.

Any help?

regards,

Ganesh

[gwcrook]

We experienced similar problems. We were instructed to use local authentication at the current time. Something about HTTP requiring authentication for each part of the page that accesses data. The configuration line is:

ip http authentication local

The single connection did not help. We were also advised that if we required ACS HTTP authentication to use RADIUS because it scaled better than TACACS and would not be as impacted as TACACS. If neither of these are an option, another workaround is to, disable logging "passed authentications". We tested this and it prevented our ACS server from pegging the cpu, memory and I/O write queues. We opted for local authentication because the lack of "passed authentication" logs impacted our troubleshooting.

Good Luck

Gerry