1

I have a 3750x with TACACS AAA configured. If I login using TACACS, CLI commands run fine, no wait between commands. However, if I disconnect from network, taking away the ability to hit the tacacs server or I log in using local account (still disconnected from server), there is a 30 second CLI delay. I am assuming AAA is still trying to hit the TACACS server and is using a default timer. Below is a link to a user with similar issues. I read the 2 suggestions but am still unclear as to which direction I need to be looking. Below is my relevant AAA: 

tacacs-server host 10.x.x.x
tacacs-server host 10.x.x.x    
tacacs-server key......... 
tacacs-server timeout 10
tacacs-server directed-request

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+ if-authenticated 
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
aaa session-id common

AAA Authorization Timeout

Improve this question
4
  • You should always include the relevant data from the link since there is no guarantee that the link won't go bad in the future. Edit your question to ask your question, and you can still have the link, too.
    – Ron Maupin ♦
    Commented Mar 10, 2016 at 2:07
  • Updated to include specific question and relevant AA commands
    – user23590
    Commented Mar 10, 2016 at 13:27
  • Unless you're running over a very slow WAN, set the timeout value to 3 seconds or less.
    – Ron Trunk
    Commented Mar 10, 2016 at 15:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 13, 2017 at 19:15

1 Answer 1

Reset to default
2

Define the local group for the secondary AAA method for authorization, that way if the servers are down it'll use the local priv level for the user account (make sure it's set to 15 for full access) and continue from there.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.