Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA 5520 Tacacs Authentication Issues

Hello All,

I am haveing some truble with my ASA getting authentication from one of my Tacacs Servers. I have two diffrent ethernet handofs to two diffrent Routers of the ASA that are getting the Tacacs Authenticatrion. One is on the DMZ interface and the other is on the Inside. However I am not able to get the ASA to authenticate against the Tacacs server

Here is what I have so far:

ASA Version 9.1(2)

!

hostname ASA1

enable password Ev0iTru97MKu8IiT encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

!

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.250.0.1 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/1

nameif DMZ

security-level 75

ip address 10.250.0.5 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/0

shutdown    

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/3

nameif outside

security-level 0

ip address dhcp setroute

!

ftp mode passive

object-group service DM_INLINE_TCP_2 tcp

port-object eq ssh

port-object eq telnet

access-list inside_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2

access-list DMZ_access_in extended permit ip any4 any4

access-list global_access extended permit ip any4 any4

pager lines 24

logging enable

logging buffered informational

mtu inside 1500

mtu DMZ 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (DMZ,outside) source dynamic any interface

nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside

access-group DMZ_access_in in interface DMZ

access-group global_access global

!            

router eigrp 99

no auto-summary

eigrp router-id 10.250.0.5

network 10.250.0.0 255.255.255.252

network 10.250.0.4 255.255.255.252

passive-interface default

no passive-interface inside

no passive-interface DMZ

!

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (DMZ) host 10.250.100.142  >>>>>>>>>>>>>>>> Tacacs Server

key ********

user-identity default-domain LOCAL

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 DMZ   >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

http 10.250.0.6 255.255.255.255 DMZ

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 10.250.100.140 255.255.255.255 DMZ  >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

ssh 10.250.0.6 255.255.255.255 DMZ

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http

https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email

callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05

: end ASA Version 9.1(2)
!
hostname ASA1
enable password Ev0iTru97MKu8IiT encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
nameif inside
security-level 100
ip address 10.250.0.1 255.255.255.252
authentication key eigrp 99 ********* key-id 99
authentication mode eigrp 99 md5
!
interface GigabitEthernet0/1
nameif DMZ
security-level 75
ip address 10.250.0.5 255.255.255.252
authentication key eigrp 99 ********* key-id 99
authentication mode eigrp 99 md5
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/0
shutdown    
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/1
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
nameif outside
security-level 0
ip address dhcp setroute
!
ftp mode passive
object-group service DM_INLINE_TCP_2 tcp
port-object eq ssh
port-object eq telnet
access-list inside_access_in extended permit ip any4 any4
access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2
access-list DMZ_access_in extended permit ip any4 any4
access-list global_access extended permit ip any4 any4
pager lines 24
logging enable
logging buffered informational
mtu inside 1500
mtu DMZ 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (DMZ,outside) source dynamic any interface
nat (inside,outside) source dynamic any interface
access-group inside_access_in in interface inside
access-group DMZ_access_in in interface DMZ
access-group global_access global
!            
router eigrp 99
no auto-summary
eigrp router-id 10.250.0.5
network 10.250.0.0 255.255.255.252
network 10.250.0.4 255.255.255.252
passive-interface default
no passive-interface inside
no passive-interface DMZ
!
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server BiHTac protocol tacacs+
accounting-mode simultaneous
aaa-server BiHTac (DMZ) host 10.250.100.142  >>>>>>>>>>>>>>>> Tacacs Server
key ********
user-identity default-domain LOCAL
aaa authentication http console BiHTac LOCAL
aaa authentication ssh console BiHTac LOCAL
aaa authentication enable console BiHTac LOCAL
aaa authentication serial console BiHTac LOCAL
aaa authentication telnet console BiHTac LOCAL
aaa authorization command BiHTac LOCAL
http server enable
http 10.250.100.140 255.255.255.255 DMZ   >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler
http 10.250.0.6 255.255.255.255 DMZ
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 10.250.100.140 255.255.255.255 DMZ  >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler
ssh 10.250.0.6 255.255.255.255 DMZ
ssh timeout 20
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny 
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip 
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05
: end

I am not quite sure how the router on the (INSIDE) interface is able to get Tacacs Authentication and the ASA itself is not. I have followed the exact steps that I found on cisco.com for tacacs authentication

Any help is greatly appreciated

Thanks

Zipp

2 REPLIES

ASA 5520 Tacacs Authentication Issues

Does the ASA know how to get to the 10.250.100.x network? From the ASA can you ping the TACACs server?

New Member

ASA 5520 Tacacs Authentication Issues

Hello,

Im sorry this is a duplicate post.. I had some issues with my other account and opened this one up but in the mean time my account issues got resolved. here is the current topic with all the troubleshooting

https://supportforums.cisco.com/message/4126617#4126617

Thanks

220
Views
0
Helpful
2
Replies
CreatePlease to create content