Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

CCS 11501 Tacacs Source Interface.

Hello all,

I am trying to use the management interface of a CCS11501 as the source interface of any Tacacs+ authentication.

I have added a managment route for the subnet where the tacacas servers are but authentication is still going via circuit VLAN1.

It will not allow me to add a "normal" route due to the overlap with the management interface.

What I really want is a tacacs source interface equivalant.

Any and all help appreciated,

Andrew.

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: CCS 11501 Tacacs Source Interface.

Andrew,

The CSS management interface is not designed to be used for user traffic flow or for tacacs, radius, syslog, ntp etc. Therefore there is no way to force tacacs traffic to use this interface. Also there is no equivelent to "ip tacacs source-interface" in IOS.

The management interface was designed to be used only for telnet, ssh and web GUI access to the CSS.

Peter

4 REPLIES
New Member

Re: CCS 11501 Tacacs Source Interface.

Andrew,

The CSS management interface is not designed to be used for user traffic flow or for tacacs, radius, syslog, ntp etc. Therefore there is no way to force tacacs traffic to use this interface. Also there is no equivelent to "ip tacacs source-interface" in IOS.

The management interface was designed to be used only for telnet, ssh and web GUI access to the CSS.

Peter

New Member

Re: CCS 11501 Tacacs Source Interface.

What version of the Content switch software are you running? I have utilized the management interface for tacacs from 1105x's to 1150x, If I just add the management route as you described it worked flawlessly.

New Member

Re: CCS 11501 Tacacs Source Interface.

Hello,

thanks for the reply and my apologies for the delay in replying.

Version details:

Version: sg0810002 (08.10.0.02)

Flash (Locked): 08.10.0.02

Flash (Operational): 08.10.0.02

Type: PRIMARY

Licensed Cmd Set(s): Standard Feature Set

New Member

Re: CCS 11501 Tacacs Source Interface.

The 11500 will refuse to talk to a TACACS server that isn't on a directly attached network. If your TACACS server isn't on that same net, you can alter the netmask on the management interface to make it beleive it is directly attached. Combine that with a management-route and a network that will proxy-arp for your TACACS server and you are all set.

489
Views
0
Helpful
4
Replies
CreatePlease to create content