R3 is a Tacacs+ client and Server0 is configured as AAA server with Tacacs+ but R3 is not able to authenticate.
R3 Configuration:
!
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R3
!
aaa new-model
!
aaa authentication login CONSOLE none
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ local
!
ip cef
no ipv6 cef
!
username backup password 0 cisco
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
!
crypto isakmp key secretkey address 209.165.100.1
!
crypto ipsec transform-set R3-R1 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp
set peer 209.165.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set R3-R1
match address 100
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0/0
ip address 209.165.200.1 255.255.255.0
duplex auto
speed auto
crypto map IPSEC-MAP
!
interface GigabitEthernet0/0/1
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.200.2
!
ip flow-export version 9
!
access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
!!
tacacs-server host 192.168.1.3 key cisco
!
!line con 0
login authentication CONSOLE
!
line aux 0
!
line vty 0 4
!
!
end
R1 Configuration:
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R1
!
!
!
!
!
!
!
aaa new-model
!
aaa authentication login CONSOLE none
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ local
!
!
ip cef
no ipv6 cef
!
username backup password 0 cisco
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
!
crypto isakmp key secretkey address 209.165.200.1
!
!
!
crypto ipsec transform-set R1-R3 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp
set peer 209.165.200.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set R1-R3
match address 100
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0/0
ip address 209.165.100.1 255.255.255.0
duplex auto
speed auto
crypto map IPSEC-MAP
!
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.100.2
!
ip flow-export version 9
!
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
!
!
tacacs-server host 192.168.1.3 key cisco
!
line con 0
login authentication CONSOLE
!
line aux 0
!
line vty 0 4
!
end
ISP Router Configuration
Current configuration : 590 bytes
!
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname ISP
!
ip cef
no ipv6 cef
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0/0
ip address 209.165.100.2 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/0/1
ip address 209.165.200.2 255.255.255.0
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
ip classless
!
ip flow-export version 9
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
end
Note: R1 and R3 has formed a VPN tunnel
ip radius source-interface <interface>
orip tacacs source-interface <interface>
ip tacacs source-interface GigabitEthernet0/0/1
on R3 and report back if it is resolved.