I have been sampling various configurations, and I seem to be missing something for my configuration, and now I have bigger problems. I applied the following accidently to my core router.
aaa authentication login default group tacacs+ local
aaa authentication login no_tacacs enable
aaa authentication enable default group tacacs+ line
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
tacacs-server host *.*.*.*
tacacs-server key BLAH-BLAH
tacacs-server timeout 60
I currently don't have a local authentication method configured, and after entering "Exit" from the config mode, I cannot get back into the config portion of the router, and receive the message "Command authorization failed"... Anyhow, on my ACS Server I keep receiving the message "Unknown NAS" when I try to access the router. I have tried to set the router up as an AAA client, to no avail, and an ACS Server, also to no avail. Any help at all will be greatly appreciated....
If you try to stop the services on the ACs server and try it will try to fall back to the local username on the router database, I am not sure if you have that or not.
Otherwise if you have a copy of the config with you, you need to add all the ip addresses of the interfaces you have in the switch, like all the fe or ethernet ports which have ip address defined in it. As we might have situation where the tacacs+ packets is getting generated with an ip address which is not there in the NAS list.
I think the consensus here is to wait until later and reset the module, since we have 2 and this is on the primary, so the standby should work out fine and coming back online. Since no configuration files were saved after the AAA change, and I (thankfully) saved some configs to TFTP, access to the module shouldn't be a problem.
With this aside, I am still amiss as far as configuring the AAA to communicate with my ACS 3.1 Server from our routers. We are not using this tool for dial-in access, and after sampling some other configurations, I am still unable to get the 2 to communicate back and forth.
Presently I have 2 ACS Servers which replicate data, and numerous switches that are configured to use ACS to authenticate, which is working like a charm. Do you have any suggestions??? Also, no ACL's are blocking access anywhere on our network right now...
As you are seeing unknown NAS as an error on the ACS server, it seems that you don't have any fw inbetween of your ACS and the router. Please enter the following command on the router to force router to source the tacacs+ authentication request using a particular interface ip address:
ip tacacs-source interface fa0/0 <--Need to change with your own actual interface.
Then make sure to define your AAA client using this ip address. It should work.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :