- [Instructor] Here, we're looking at
the same configuration output as our previous video,
and we want to specifically look at
our TACACS+ configuration
and see what we might want to troubleshoot.
Again, we need to make sure that AAA is enabled globally
for this to work,
which we can see here with the AAA new hyphen model output.
So where do we go next?
Well, I would start with making sure that our TACACS+ server
is correctly identified by IP address.
And we can see that here in our output.
We can see that
this is configured with the given name TACACS1,
and we can also see that it has an IP address of 10.1.1.50.
So obviously,
if we've incorrectly configured this IP address,
our TACACS+ communication is not going to work.
This can also be tested from the router
with the command test, AAA.
In my lab environment,
I'm not actually running a AAA server
so I won't run that command.
I know that's going to fail for me,
but that's a way that you can test the reachability.
You can also try to telnet to reach
the authentication port number of the AAA server
and that will also verify connectivity.
By default, TACACS+ uses TCP port 49 for all three pieces,
authentication, authorization and accounting.
So it's a good idea to test that port
and make sure it isn't blocked for some reason.
Right underneath that we see our pre shared key.
We see that it says key TAC password.
With this pre shared key,
it's important to make sure that it's correct here
in your router configuration and on the server itself.
So if those keys don't match
then communication is going to fail
between the router and the TACACS server.
If you find that the user can authenticate correctly
but they can't perform any commands,
then this points to an authorization problem
and that means you should make sure
that the user has been authorized on the server side
to execute the commands that he or she needs.
If you're using server groups, as we see here,
make sure you have included the TACACS server in that group.
So if we look at our AAA server group for TACACS+,
we see here that the group is called TACACS group
and it has included a server with the name TACACS1,
which we looked at already below,
is identified as our TACACS+ server.
And so that's good, that's what we would want to see.
Next up is the method list.
We again have two method lists here,
one for VTY lines and one for the CONSOLE line.
And so in this configuration, the VTY line method list
specifically points to our TACACS group,
so we need to make sure
that we're using the correct service for that method list.
So for example, if we go under global configuration mode
and we say AAA authentication,
and then we look at our context sensitive help,
you can see a list of all the services that we can use here.
So we wouldn't want to use something like
dot1x or maybe PPP.
We wouldn't want to use those services
when we're using the method list
on the CONSOLE and VTY lines.
So that's not going to work.
The method list should match the service
for which you are creating the list.
And if we go back up to our output,
we can see that it does in fact, do that.
We're using the login method, VTY line.
The group is a TACACS+ group,
and we have the backup method for local at the end of that
We also need to make sure that the method lists
are actually applied to the lines.
We can see in our output under the VTY lines,
if we highlight that, VTY line zero through four,
the login authentication
is pointing to the VTY line method list,
which we already looked at
and said that the VTY line method list
is pointing to our TACACS server group.
So if this line is not in place,
if we're not pointing to the method list
under our actual line, then that's not going to work either.
It's going to default to local login
and we are not going to have TACACS authentication
taking place on the VTY lines.
Now on the actual server itself,
you want to make sure
your usernames and passwords are created.
Remember we looked at those on the router
when we examined local database troubleshooting.
We discussed how we had to have
actual usernames and passwords in place.
And it's the same with a TACACS+ server.
That needs to be checked on the server itself
to make sure you have users configured.
Also make sure that on the server,
the router's IP address is correctly specified.
So not only is our router
pointing to the TACACS+ server IP address of 10.1.1.50,
but our server is also pointing back to the router.
Notice our COMMAND line output
under our TACACS+ configuration,
that says IP TACACS source-interface loopback1.
So it's best practice to set the IP address
of a loopback interface
as the source IP address for TACACS+ communication.
If the source interface is not configured
with the IP address
that the TACACS+ server is expecting to see
then the AAA services are not going to work.
So again, make sure the server itself
is pointing to the correct IP address on the router.
So that's a look at troubleshooting TACACS+.
In the next video,
we'll look at troubleshooting our radius method.