We have two VSS switch pairs, one which has TACACS working correctly with a similar config to this:

    aaa group server tacacs+ TacacsVrf
      server-private key 7 ourKeyIsSecret
      ip vrf forwarding mgmtVrf
      ip tacacs source FastEthernet1

with the source interface an individual gigE interface.

We have a second pair (6807xl) with the same config, but using a port-channel Interface as the source interface. TACACS requests are not getting to the ACS as far as I know.

  • 1
    Is the port channel interface a layer 3 interface? can you ping that interface from the ACS? Have you looked at the ACS log to see if traffic is reaching it? – Ron Trunk Jan 9 '15 at 1:56
  • Yes. Ultimately, they did find an issue with the ACS configuration. Not sure exactly what, but they backed out the old one, reconfigured, and then had no issues with authentication. The first thing I asked them to do was AAA debug, but they assured me it wasn't the ACS config, which was the first thing I asked them to check. This drove the issue to get me ACS access, so I'm going to call it a win. – LawwDogg Jan 20 '15 at 13:34

Browse other questions tagged or ask your own question.