Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

ip tacacs source interface command

Hi All,

We have a mgmt. subnet of 10.16.0.0/16 that we use for vlan1 and loopback0 interfaces on our devices. We have a vty access list that includes 10.16.0.0/16 for telenet/ssh access so that we can hop form one router to another directly.

I also have "ip tacacs source interface vlan1" or "ip tacacs source interface loopback0" commands on all our devices.

But when I try to hop form one router to another, I get "connection refused from remote host". Looks like the "ip tacacs source interface" command does not take any effect.

Any suggesetions?

thanks,

Meena

7 REPLIES

Re: ip tacacs source interface command

Meena,

The error "connection refused from remote host" is generally associated when the telnet session is blocked by an access-list.

Tacacs error on the other hand is mostly an authentication failure error.

whenever a telnet session is initiated, the source IP initiating the session is the IP of the interface leading to the destination. You need to make sure that this IP is allowed in the access-list.

To isolate the problem to either Tacacs or telnet, Remove one of the device detail from the Tacacs server and try logging onto the router.

HTH, rate if it does.

Narayan

Re: ip tacacs source interface command

Hi Meena,

Should you not have configured "ip telnet source interface loopback0" and not "ip tacacs source interface loopback0"?

Community Member

Re: ip tacacs source interface command

I tried using "ip telnet source interface loopback0" and it seems to work. Obviuosly, it is not a TACACS problem but the vty ACL problem. But looks like there is no equivalnet ssh command like "ip ssh source interface".

Thanks for all the replies.

Hall of Fame Super Gold

Re: ip tacacs source interface command

Meena

In my routers running 12.3 code there is a command ip ssh source-interface. I am not clear which version introduced this command. It may not be in the version of code that you are running. But it certainly exists in some versions of IOS.

HTH

Rick

Community Member

Re: ip tacacs source interface command

Rick,

You are correct. I upgraded the image and now I see the "ip ssh source-interface" command.

Thanks for your help.

Meena

Hall of Fame Super Gold

Re: ip tacacs source interface command

Meena

I am glad that we were able to help find a solution for your issue. Thanks for posting back to the forum indicating that the issue was resolved. It makes the forum more useful when people can read about an issue and can see that there was a solution found.

HTH

Rick

Re: ip tacacs source interface command

In addition to what Rick has said, i would like you to change the post status to resolved

Narayan

1190
Views
10
Helpful
7
Replies
CreatePlease to create content