ACS 5.1 13030 TACACS+ Authentication Error Question

[stanleylam7_2]

Hi all,

I am in the process of setting up a new TACACS+ server and am in the process of updating all of our network devices' configurations to point to the new server.  Everything is looking fine so far, but on the ACS monitoring tool, two of our switches are constantly spamming "13030 TACACS+ Authentication request missing a User name" error.  The network admin group have no problems authenticating to these two switches and they confirm it is not them trying to log in.  Does anyone know if ACS monitor will show any souce IP addresses from these requests?

[Yudong Wu · Accepted solution]

If you click the detail in your authentication error message, you should be able to find "Remote-Address" field which should tell you the remote IP.

If you did not see any IP in "Remote-Address" field, you might need to check the switch console/AUX port to see if something is connected to there, which might cause the issue.

[David Fitzgerald]

I have the same error.  The Remote Address states 'async' and the device in question is acting as a TSR. thus, it appears that garbage on an ASYNC line is being interpreted as a login attempt.  Not a pretty site in my logs.