1

I am trying to set up TACACS+ for a project. The below image shows the layout of the network.

Network Diagram

So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication etc. for the ASA Firewall (HQ-FW1). I believe have the setup correct on the HQ Router (HQ) as when I run the command:

test aaa group tacacs+ admin Cisco legacy

I can see a TCP SYN packet being sent from HQ e0/1 to the tacacs server on port 49 but no response, and capturing from HQ-FW1 Gi0/1 I see nothing.

I've added an ACL to HQ-FW1 which is applied to the outside interface:

access-list OUTSIDE-ACL extended permit tcp host 192.168.20.1 host 192.168.10.10 eq tacacs

(192.168.20.1 is e0/1 on the router and 192.168.10.10 is the TACACS+ server.)

Am I missing some other command needed to permit the traffic or is my ACL wrong? Happy to add any config info/outputs etc. if it would help.

ASA Config


: 
: Serial Number: 9AUN2D30JLX
: Hardware:   ASAv, 2048 MB RAM, CPU Pentium II 2000 MHz
: Written by localadmin at 20:03:49.299 UTC Sun Nov 28 2021
!
ASA Version 9.5(2)204 
!
hostname HQ-FW1
domain-name asecuritycompany.com
enable password 8Ry2YjIyt7RRXU24 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
 description TO THE HQ ROUTER OUTSIDE 192.168.20.0/30 NETWORK
 nameif outside
 security-level 0
 ip address 192.168.20.2 255.255.255.252 
!
interface GigabitEthernet0/1
 description TO THE HQ INSIDE 192.168.10.0/24 NETWORK
 nameif inside
 security-level 100
 ip address 192.168.10.2 255.255.255.0 
!
interface GigabitEthernet0/2
 description TO THE WEB_DMZ 192.168.30.0/29 NETWORK
 nameif web-dmz
 security-level 40
 ip address 192.168.30.1 255.255.255.248 
!
interface GigabitEthernet0/3
 description TO THE HQ FTP DMZ NETWORK 192.168.40.0/29
 nameif ftp-dmz
 security-level 60
 ip address 192.168.40.1 255.255.255.248 
!
interface GigabitEthernet0/4
 description TO THE HQ CLIENT DMZ NETWORK 192.168.50.0/29
 nameif client-dmz
 security-level 50
 ip address 192.168.50.1 255.255.255.248 
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
dns server-group DefaultDNS
 domain-name asecuritycompany.com
object network net-local
 subnet 192.168.10.0 255.255.255.0
object network net-outside
 subnet 192.168.20.0 255.255.255.252
object network net-web-dmz
 subnet 192.168.30.0 255.255.255.224
object network net-ftp-dmz
 subnet 192.168.40.0 255.255.255.224
object network net-client-dmz
 subnet 192.168.50.0 255.255.255.224
object network net-dmz-web-server
 host 192.168.30.2
object network net-dmz-ftp-server
 host 192.168.40.2
object network net-dmz-client-server
 host 192.168.50.2
object network net-remote
 subnet 10.1.10.0 255.255.255.0
access-list OUTSIDE-ACL extended permit tcp host 192.168.20.1 host 192.168.10.10 eq tacacs 
access-list OUTSIDE-ACL extended permit ip any host 192.168.30.2 
access-list BRFTPACL extended permit ip object net-local object net-remote 
access-list CLIENT-VPN-LIST webtype permit tcp host 192.168.50.2 eq www
access-list CLIENT-VPN-LIST webtype deny tcp any
access-list CLIENT-VPN-LIST webtype deny url any
pager lines 23
mtu outside 1500
mtu inside 1500
mtu web-dmz 1500
mtu ftp-dmz 1500
mtu client-dmz 1500
no failover
no monitor-interface service-module 
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static net-local net-local destination static net-remote net-remote
!
object network net-local
 nat (inside,outside) dynamic interface
object network net-dmz-web-server
 nat (web-dmz,outside) static 209.165.200.227
access-group OUTSIDE-ACL in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.20.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
aaa-server HQ-TACACS-GROUP protocol tacacs+
 reactivation-mode timed
aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10
 key testing123
user-identity default-domain LOCAL
aaa authentication serial console HQ-TACACS-GROUP LOCAL
aaa authentication telnet console HQ-TACACS-GROUP LOCAL
aaa authentication ssh console HQ-TACACS-GROUP LOCAL
aaa authentication enable console HQ-TACACS-GROUP LOCAL
aaa authorization command HQ-TACACS-GROUP LOCAL
aaa accounting ssh console HQ-TACACS-GROUP
aaa accounting enable console HQ-TACACS-GROUP
aaa accounting command HQ-TACACS-GROUP
aaa accounting serial console HQ-TACACS-GROUP
aaa accounting telnet console HQ-TACACS-GROUP
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set BRFTPTRANS esp-aes-256 esp-sha-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto map BRFTPMAP 1 match address BRFTPACL
crypto map BRFTPMAP 1 set pfs group1
crypto map BRFTPMAP 1 set peer 10.1.1.2 
crypto map BRFTPMAP 1 set ikev1 transform-set BRFTPTRANS
crypto map BRFTPMAP interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpool policy
 auto-import
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
 cache
  disable
 error-recovery disable
group-policy CLIENT-VPN-POLICY internal
group-policy CLIENT-VPN-POLICY attributes
 webvpn
  filter value CLIENT-VPN-LIST
dynamic-access-policy-record DfltAccessPolicy
username localadmin password zDkbp36jt66L0Z6u encrypted privilege 15
username vpntemp password VTXQbFOPKnQDvIdw encrypted
tunnel-group 10.1.1.2 type ipsec-l2l
tunnel-group 10.1.1.2 ipsec-attributes
 ikev1 pre-shared-key SECRET-KEY
tunnel-group CLIENT-VPN-GROUP type remote-access
tunnel-group CLIENT-VPN-GROUP general-attributes
 default-group-policy CLIENT-VPN-POLICY
 authorization-required
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
  inspect icmp 
  inspect http 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
 profile License
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination transport-method http
Cryptochecksum:e63cf43d3932782eb38e32959344b993
: end

HQ Router Config


!
! Last configuration change at 20:06:11 GMT Sun Nov 28 2021 by localadmin
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname HQ
!
boot-start-marker
boot-end-marker
!
!
!
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authentication login CONSOLE-LINE local
aaa authentication login HQTACACS group tacacs+ local
!
!
!
!
!
aaa session-id common
clock timezone GMT 0 0
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
!
!
!


!
!
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
username localadmin privilege 15 secret 5 $1$mX0o$aBpVy.ik5ak8ev4wq9IRf1
!
redundancy
!
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 no shutdown
 description TO THE ISP-HQ NETWORK 209.165.200.224/30
 ip address 209.165.200.226 255.255.255.224
!
interface Ethernet0/1
 no shutdown
 description TO THE HQ NETWORK 192.168.10.0/24
 ip address 192.168.20.1 255.255.255.252
!
interface Ethernet0/2
 no shutdown
 no ip address
 shutdown
!
interface Ethernet0/3
 no shutdown
 no ip address
 shutdown
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 10.1.1.0 255.255.255.252 Ethernet0/0
ip route 10.1.10.0 255.255.255.0 Ethernet0/0
ip route 192.31.7.32 255.255.255.224 Ethernet0/0
ip route 192.168.10.10 255.255.255.255 Ethernet0/1
ip route 198.133.219.0 255.255.255.252 Ethernet0/0
ip route 209.165.200.227 255.255.255.255 Ethernet0/1
ip route 209.165.200.228 255.255.255.255 Ethernet0/1
!
!
!
tacacs-server directed-request
tacacs server HQTACACS
 address ipv4 192.168.10.10
 key testing123
!
!
!
control-plane
!
!
!
!
!
!
!
!
line con 0
 logging synchronous
 login authentication CONSOLE-LINE
line aux 0
line vty 0 4
 transport input none
!
!
end

Wireshark trace captured from Gi0/0 on HQ-FW1, showing packet sent but not getting through Firewall. (no packets are captured from Gi0/1)

Wireshark Trace

Packet Tracer Output:

HQ-FW1(config)# packet-tracer input outside tcp 192.168.20.1 1234 192.168.10.1$

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 192.168.10.10 using egress ifc  inside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group OUTSIDE-ACL in interface outside
access-list OUTSIDE-ACL extended permit tcp host 192.168.20.1 host 192.168.10.10 eq tacacs
Additional Information:

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: QOS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
object network net-local
 nat (inside,outside) dynamic interface
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Improve this question
3
  • 1
    You need to at least post the full sanitized AAA, AAA-SERVER, and TACACS sections of your config here, if not the whole sanitized ASA config. We can’t just guess what your config looks like.
    – Jesse P.
    Nov 28, 2021 at 19:00
  • Education and homework questions are off topic here.
    – Ron Trunk
    Nov 29, 2021 at 16:10
  • Where would be the appropriate place to post them?
    – DavidM
    Nov 29, 2021 at 16:15

1 Answer 1

Reset to default
3

On your router, all of your static routes pointing to your firewall are wrong. You need to define the next hop since you aren’t on a PTP link.

Please remove all of the routes pointing to Eth0/1 using the commands:

no ip route 192.168.10.10 255.255.255.255 Ethernet0/1
no ip route 209.165.200.227 255.255.255.255 Ethernet0/1
no ip route 209.165.200.228 255.255.255.255 Ethernet0/1

And replace them with:

ip route 192.168.10.10 255.255.255.255 192.168.20.2
ip route 209.165.200.227 255.255.255.255 192.168.20.2
ip route 209.165.200.228 255.255.255.255 192.168.20.2

You should then be able to retest and verify your firewall is receiving packets now.

Separately, you should repeat the steps above (with modification) for your Eth0/0 interface, pointing those routes to your next hop, which is likely a router from your ISP).

Edit 1: Please also set the source interface for TACACS with the command ip tacacs source-interface Eth0/1

Edit 2: To correct your NAT issue, which is dropping your traffic due to RPF checking, you can make a very specific NAT exemption statement which will take precedence over the broad NAT statement this traffic is currently being matched against, without interfering with any of your other traffic.

You'll need to first create some more objects. To do so, you can type:

object network TACACS-HOST
 host 192.168.10.10
object network HQ-ROUTER
 host 192.168.20.1

Next, you can add a NAT exemption statement using those new objects. To do so, you can type:

nat (outside,inside) source static HQ-ROUTER HQ-ROUTER destination static TACACS-HOST TACACS-HOST

You can then verify flow with the same packet-tracer command as I mentioned previously, or you can just try an authentication request.

Improve this answer
12
  • 1
    @DavidM Please update your config for the router so I can see what it looks like now. Also, you may need to also set the source interface for TACACS to use.
    – Jesse P.
    Nov 28, 2021 at 22:53
  • 1
    @DavidM I edited the answer to include the source interface command.
    – Jesse P.
    Nov 28, 2021 at 22:58
  • 1
    I see the screenshot now. So, you see the request coming into the firewall from the router but no response packets back from the ACS server.
    – Jesse P.
    Nov 28, 2021 at 23:02
  • 1
    @DavidM Does your ACS server have a route back to the router? Does it know how to reach 192.168.20.1 (for example, does it have a static route defined on it or the default gateway set to send traffic to the ASA)? Is there a local firewall enabled on the ACS host that may be blocking the request?
    – Jesse P.
    Nov 28, 2021 at 23:06
  • 1
    @DavidM What makes you think it’s being blocked by the ASA? Do you see any log entries actually saying the traffic was denied? Have you tried simulating the traffic with packet-tracer to see which rules and routes the traffic will take? Just because TACACS works for the ASA itself has no impact on it working for other devices or traffic passing through the firewall. ACS has its own filters that could be denying the router from being able to use it, or there could be a host-based firewall (such as Windows Firewall or IPTables) denying the traffic. Or it could be a lack of a route back.
    – Jesse P.
    Nov 29, 2021 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.