- Log into a Cisco IOS device with TACACS Authorization enabled
- Do a command that causes the device to lose access to the TACACS server
- Enter a command that requires TACACS Authorization
By default, the timeout appears to be about 30 seconds before the devices comes back with "Command Authorization Failed."
I tried this command to fix...
tacacs-server timeout <seconds>
However, that only affects the authentication portion, not authorization.
How do you adjust the timeout to communicate with a TACACS server for authorization purposes?
Edit: Relevant config pasted below.
Note that I am fine with the user getting a "Command Authorization Failed" message if the TACACS server goes down. I just don't want them to have to wait 30 seconds between each command for the server to timeout.
My concern is that if someone pastes 75 lines into the router, and line 3 breaks connectivity to the TACACS server, the remaining 72 lines will be in buffer. By my understanding, even if you close the SSH session to the router it will STILL process the commands in the buffer.
Therefore what happens if the router is rejecting commands at the rate of 2 per minute (Command Authorization Failed), and you fix the problem after 5 minutes? 62 lines suddenly paste in and are immediately applied, and you just did a partial deployment of your change! How do you explain THAT to management?
Ideally, I'd like to setup a 3 second timeout for authorizations with the TACACS server. At least then the chances of the above disaster scenario are greatly reduced.
tacacs-server host xx.xx.xx.27 tacacs-server host xx.xx.xx.28 tacacs-server key xxxxx ! aaa new-model ! aaa group server tacacs+ ACS1 server xx.xx.xx.27 server xx.xx.xx.28 ! aaa authentication login default group ACS1 line local ! aaa authorization config-commands aaa authorization exec default group ACS1 local aaa authorization commands 15 default group ACS1 local ! aaa accounting commands 0 default start-stop group ACS1 aaa accounting commands 15 default start-stop group ACS1 aaa accounting connection default start-stop group ACS1 ! aaa authentication login console-authc none !