1

I have a Cisco router connected to a TACACS server via two interfaces. As a prerrequisite, no loopback should be set on the router. My question is:

Is it possible to set these two interfaces as source interfaces in my router? The Cisco command to set a source interface for TACACS is:

ip tacacs source-interface <my-interface>

Thanks,

Regards,

Luis

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 19:06

1 Answer 1

Reset to default
1

Not using a loopback address can cause many problems, as you will likely discover on your own ;-p

The command you quote is used to specify the source interface, if I understand your question. You can only specify one.

If you don't specify the source interface, the router will use the interface closest to the destination, based on the routing table. If you don't specify an interface, then the source interface can change if there is a topology change. Your AAA server may not recognize the new address.

If you do specify a physical interface and that interface goes down, TACACS stops working.

If you use a loopback interface, the source address never changes, since the interface never goes down. This is considered a good practice.

Improve this answer
2
  • I understand using a loopback is a good practise. For some reasons we´re not allowed to use it. Topology changes can cause problems (the change on the preferred interface you properly explain), so we´d like to add our two possible interfaces as source interfaces. Maybe it´s possible by making a group of interfaces, and then assigning it as a source. Is it?
    – Luis Andrés García
    Commented Jan 27, 2017 at 13:13
  • 1
    I don't believe it's possible. I would specify the interface that is least likely to change when the topology changes, and hope for the best. You should also create a local account so you can still get into the router when TACACS fails.
    – Ron Trunk
    Commented Jan 27, 2017 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.