ISE 3.3 & Catalyst 3750 AAA Tacacs + config with VRF's

[Adcom911]

Hello,

Running into an issue of we are not able to get the 3750 running version 12.2(55)SE3 to communicate with ISE.  I'll post the current config we have here below for assistance:

aaa new-model
!
!
aaa group server tacacs+ ISE_TACACS
 server 192.168.12.13
 server 192.168.12.14
 ip vrf forwarding MGMT
 ip tacacs source-interface Vlan54
!
aaa authentication login default group tacacs+ local
aaa authentication enable default group ISE_TACACS enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group ISE_TACACS local 
aaa authorization commands 0 default group ISE_TACACS none 
aaa authorization commands 1 default group ISE_TACACS if-authenticated 
aaa authorization commands 15 default group ISE_TACACS if-authenticated 
aaa accounting exec default start-stop group ISE_TACACS
aaa accounting commands 1 default start-stop group ISE_TACACS
aaa accounting commands 15 default start-stop group ISE_TACACS
aaa accounting connection default start-stop group ISE_TACACS
!
!
!
aaa session-id common
!

ip tacacs source-interface Vlan54
!
access-list 10 permit 192.168.12.13
access-list 10 permit 192.168.12.14
!
tacacs-server host 192.168.12.13
tacacs-server host 192.168.12.14
tacacs-server directed-request
tacacs-server key 7 XXXXX
!
tacacs-server host 192.168.12.13
tacacs-server host 192.168.12.14
tacacs-server directed-request
tacacs-server key 7 XXXXX

The wild things is we can ping from the 3750 vrf MGMT to the ISE servers and from the ISE servers we can ping and reach the 3750. Not sure what we are missing on this one. 

[Flavio Miranda]

@Adcom911 

 Do you have the vrf config under vlan 54? 

 If you ping the ISE using as source the vlan 54 does it work? 

[Adcom911]

ahh interesting its not able to ping that so thats part of the issue then. Do you know that the source interface the default ping is using? Or how to find that out? We don't have any routes in the default routing table so I'm wondering which interface is it using to ping when given the VRF MGMT command

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.12.13, timeout is 2 seconds:
Packet sent with a source address of X.X.X.X 
.....
Success rate is 0 percent (0/5)

interface Vlan54
 ip vrf forwarding MGMT
 ip address X.X.X.X X.X.X.X
end

#ping vrf MGMT 192.168.12.13

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.12.13, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms
Adcom3750X-CE1#

[Flavio Miranda]

If should use the routing table for VRF MGMT when you ping with source vlan 54. 

 how many interfaces do you have under VRF MGMT? 

[Adcom911]

We got quite a few under that vrf. Loopback 1 is our mgmt ip for the device and  vlan54 is directly into the firewall. From the firewall i've ran the packet tracer and its all allowed from the switch to ise. Kinda stomped on whats going on. 

                                                                    Lo1                    
                                                                   Vl51
                                                                   Vl55
                                                                   Vl60
                                                                   Vl63
                                                                   Vl301
                                                                   Vl54
                                                                   Vl35

[Flavio Miranda]

If you ping and source all  this interface one by one ?  The one the ping succeed might be the one the switching is using

 My suspicion is  the loopback interface

[Adcom911]

I've tested them all and put them as the source interface. It feels like the command under the group of ISE servers doesn't do it. I've tried the command in both locations

[Flavio Miranda]

Am I wrong or only the vlan 54 does not ping? 

If you try to add another interface on the TACACS config?

[Adcom911]

Sorry there was output above it. The vlan 35 does NOT ping the ise server. 

Sorry what do you mean add another interface in the tacas config? 

[Flavio Miranda]

For example, try to send using the Loopback1

!
aaa group server tacacs+ ISE_TACACS
 server 192.168.12.13
 server 192.168.12.14
 ip vrf forwarding MGMT
 ip tacacs source-interface Loopback1
!

[Adcom911]

WOOT WOOT that worked!! thank you! Now the issue is im getting command authorization failed. Could I just temporary add in the same credentials I have to my AD store and see if that gets it working? 

[Flavio Miranda]

This line here:

aaa authorization commands 15 default group ISE_TACACS if-authenticated 

Should allow you.

[MHM Cisco World]

aaa authentication login default group  ISE_TACACS local

try above and check

MHM

[Adcom911]

 LFG thank you @Flavio Miranda and @MHM Cisco World  for the help!!!!