1

R3 is a Tacacs+ client and Server0 is configured as AAA server with Tacacs+ but R3 is not able to authenticate.

R3 Configuration:

!
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R3
!
aaa new-model
!
aaa authentication login CONSOLE none 
aaa authentication login default group tacacs+ local 
aaa authentication enable default group tacacs+ local 
!
ip cef
no ipv6 cef
!
username backup password 0 cisco
!
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
!
crypto isakmp key secretkey address 209.165.100.1
!
crypto ipsec transform-set R3-R1 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp 
 set peer 209.165.100.1
 set pfs group5
 set security-association lifetime seconds 86400
 set transform-set R3-R1 
 match address 100
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0/0
 ip address 209.165.200.1 255.255.255.0
 duplex auto
 speed auto
 crypto map IPSEC-MAP
!
interface GigabitEthernet0/0/1
 ip address 192.168.3.1 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.200.2 
!
ip flow-export version 9
!
access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
!!
tacacs-server host 192.168.1.3 key cisco
!
!line con 0
 login authentication CONSOLE
!
line aux 0
!
line vty 0 4
!
!
end

R1 Configuration:

version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R1
!
!
!
!
!
!
!
aaa new-model
!
aaa authentication login CONSOLE none 
aaa authentication login default group tacacs+ local 
aaa authentication enable default group tacacs+ local 
!
!
ip cef
no ipv6 cef
!
username backup password 0 cisco
!
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
!
crypto isakmp key secretkey address 209.165.200.1
!
!
!
crypto ipsec transform-set R1-R3 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp 
 set peer 209.165.200.1
 set pfs group5
 set security-association lifetime seconds 86400
 set transform-set R1-R3 
 match address 100
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0/0
 ip address 209.165.100.1 255.255.255.0
 duplex auto
 speed auto
 crypto map IPSEC-MAP
!
interface GigabitEthernet0/0/1
 ip address 192.168.1.1 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.100.2 
!
ip flow-export version 9
!
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
!
!
tacacs-server host 192.168.1.3 key cisco
!
line con 0
 login authentication CONSOLE
!
line aux 0
!
line vty 0 4
!
end

ISP Router Configuration

Current configuration : 590 bytes
!
version 15.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname ISP
!
ip cef
no ipv6 cef
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0/0
 ip address 209.165.100.2 255.255.255.0
 duplex auto
 speed auto
!
interface GigabitEthernet0/0/1
 ip address 209.165.200.2 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
!
ip flow-export version 9
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
end

Note: R1 and R3 has formed a VPN tunnel

enter image description here

enter image description here

11
  • Server configuration is off topic here, but you seem to have the Server Type set to "Radius." Does it work when the Client and server are connected without a tunnel?
    – Ron Trunk
    Sep 4, 2019 at 18:50
  • 1
    To use a AAA server over a site-to-site tunnel, the traffic must source from an inside interface, to be included in the traffic allowed over the tunnel, even though you technically reach the server through your outside interface. Have you tried defining which interface that specific server is to be accessible from? For example, ip radius source-interface <interface> or ip tacacs source-interface <interface>
    – Jesse P.
    Sep 4, 2019 at 20:22
  • 1
    @ReshadZazai Then that's likely your problem. Like I said, it needs to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your outside interface, and fail. Please add the command ip tacacs source-interface GigabitEthernet0/0/1 on R3 and report back if it is resolved.
    – Jesse P.
    Sep 5, 2019 at 12:06
  • 1
    The best practice, and what can save you many such headaches in the future, is to have a loopback interface and use its address as the source for your router when using protocols from the router. Besides the TACACS+ source interface, you can use it as the source address for things like FTP, TFTP, SSH, DNS, NTP, NetFlow, logging, iBGP, IPSLA, SNMP, RADIUS, etc. A loopback interface will never go down, and you can have a consistent source address for everything when troubleshooting problems. Just be sure to include its address in interesting traffic.
    – Ron Maupin
    Sep 5, 2019 at 12:57
  • 1
    For example, suppose you had several inside interfaces, and you choose one for the source for your TACACS+. Then, that interface goes down, but you still have other interfaces up through which you can get to the router. TACACS+ will not work because the source address is now gone, but if you had used a loopback interface as the source, you could still use TACACS+. The same goes for any other protocol where you used the loopback as the source address.
    – Ron Maupin
    Sep 5, 2019 at 14:03

1 Answer 1

3

You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your outside interface, and fail. Please add the command ip tacacs source-interface GigabitEthernet0/0/1 on R3 and report back if it is resolved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.