Solved: Cisco ACS problem

Anand Narayana · ‎02-09-2007

Hi,

i have configured the cisco acs server, it is working fine with the all the switches expect for the switch which has got the multiple vlan interfaces, what could be the problem? was it because that it has got multiple interfaces & multiple IP addresses?

everything is perfect, i mean the key #, tacacs server ip address, switch is also reachable to the tacacs server(ACS).

aaa new-model

aaa authentication login default group tacacs+ enable local

aaa authentication enable default group tacacs+ enable

aaa authorization exec default group tacacs+ if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa accounting exec default start-stop group tacacs+

tacacs-server host 10.203.1.92 key checkingtheswitch

tried with 2950/2950/3550/3750 as the edge switches, it works fine,but doesn't work on 3750 which is the vlan server having multiple vlan interfaces.

Richard Burts · ‎02-09-2007

Anand

I think it is likely that your TACACS requests to the ACS server are being sourced from an interface address that is not the address that you configured on the server for this switch. In configuring the ACS server you can identify only a single IP address for each remote device. The remote device must use that IP address as the source address in its TACACS requests. In remote devices with a single VLAN or a single interface into the part of the network where the ACS server is located, the situation is easy because the remote device will automatically use the correct address. But in devices which have multiple VLANs or multiple interfaces into the part of the network where the ACS server is located it is possible that the device will use a different address as the source address of the TACACS request.

The way to fix this issue is to use the command ip tacacs source-interface and to specify the inteface with the address that corresponds to the address configured in the ACS server.

HTH

Rick

HTH

Rick

View solution in original post

Richard Burts · ‎02-09-2007

Anand

I think it is likely that your TACACS requests to the ACS server are being sourced from an interface address that is not the address that you configured on the server for this switch. In configuring the ACS server you can identify only a single IP address for each remote device. The remote device must use that IP address as the source address in its TACACS requests. In remote devices with a single VLAN or a single interface into the part of the network where the ACS server is located, the situation is easy because the remote device will automatically use the correct address. But in devices which have multiple VLANs or multiple interfaces into the part of the network where the ACS server is located it is possible that the device will use a different address as the source address of the TACACS request.

The way to fix this issue is to use the command ip tacacs source-interface and to specify the inteface with the address that corresponds to the address configured in the ACS server.

HTH

Rick

HTH

Rick

Anand Narayana · ‎02-09-2007

Hi Rick,

Thank you so much, it exactly work as you have mentioned abt the ip tacacs source-interface, thank you so much once again.

Richard Burts · ‎02-09-2007

Anand

Thank you for posting to the forum and indicating that your problem was solved. (and thank you for the rating) It makes the forum more useful when people read about a problem and know that they will be able to read the solution to that problem.

I encourage you to continue your participation in the forum.

HTH

Rick

HTH

Rick

royalblues · ‎02-09-2007

Anand,

Your NAS configuration (ip address) in the ACS should match with the interface generating the tacacs request.

use the ip tacacs source-interface command to rectify this.

Its usggested to have a loopback address on all such devices and send the tacacs request via the loopback which will be configured on the ACS

HTH, rate if it does

Narayan

Anand Narayana · ‎02-09-2007

Hi Rick, thanks for commenting abt my rate, i feel top of the world now :-).

Narayan,

i have configured one of the vlan interface as "tacacs source-interface vlan 5", in the ACS i had given the vlan 5 interface ip address & there is no problem.