I configured the ACS box with a LAN infrastructure client including the correct client ip addresses of the devices, a key and set to authenticate using TACACS+. I configured a test user in the local ACS Internal database. I then configured a switch with the ACS IP address and the correct key. When I then try to login to the switch it fails and the following is logged in in the ACS failed attempts log:
08/29/2007 11:39:22 Authen failed .. Default Group .. (Default) Key Mismatch .. .. .. x.x.x.x.. .. .. .. .. LAN-Switches LAN-Infrastructure
I have triple checked that the keys are correct and yet the reason listed for failure is a key mismatch. I don't know if I've got something wrong in the config or if there is a bug.
Cisco switch config:
aaa new-model
aaa authentication attempts login 5
aaa authentication login default group tacacs+ local
aaa authentication login console local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa authorization commands 15 no_tacacs none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
!
tacacs-server host x.x.x.x
no tacacs-server directed-request
tacacs-server key xxx
radius-server source-ports 1645-1646
ACS version:
CiscoSecure ACS
Release 4.0(1) Build 44
what could be worng
