For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

BMAN1_160384's avatar
BMAN1_160384
Icon for Nimbostratus rankNimbostratus
Jun 10, 2014

Authentication web/ssh access with TACACS

Hi All, I am trying to configure my f5 11.3.0 environment to authenticate access to the devices through TACACS+ With Cisco ACS v4.2. The log at the /var/log/secure doesn't really show something. I configure the service name as ppp and ip for the Protocol Name. I try with encryption disable or enable. At the ACS log i see 'Key Mismatch' and after changing the secret it still the same "error". Can anyone please let me knoe if there is a known error or specific configuration i missed with that TACACS+ configuration on a f5 11.3 device?

 

application delivery
BIG-IP Access Policy Manager (APM)
cisco
deployment
LTM
management
security

9 Replies

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Jun 10, 2014

    Does your TACACS secret contain special characters? If so, change it to something simple (just text) to prove that part works.

     

    Have you already built remote role configurations on your BIG-IP?

     

  • BMAN1_160384's avatar
    BMAN1_160384
    Icon for Nimbostratus rankNimbostratus
    Jun 10, 2014

    i did try a simple secret. remote role configurations on BIG-IP? i was reading about it, understand it regarding to groups that are configure on a remote server as LDAP no? do i have to configure it? if i configure the big-ip to work with RADIUS (IETF) it all works good but i cant use radius.

     

    • Cory_50405's avatar
      Cory_50405
      Icon for Noctilucent rankNoctilucent
      Jun 10, 2014
      That should work for authenticating users, but that's a dangerous thing to put in place. Without an authorization policy, you could be giving anyone full admin access to your BIG-IP.
  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Jun 10, 2014

    Remote role configurations will be a must if you want to eliminate the need for local accounts on your BIG-IP appliances. Remote roles pertain to the authorization piece of the remote auth solution.

     

    http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_implementations_guide_10_1/sol_mgmt_auth.html

     

    I suspect in your case you still have some issue on the ACS side, as it sounds like your TACACS server configuration on the BIG-IP side is correct.

     

  • BMAN1_160384's avatar
    BMAN1_160384
    Icon for Nimbostratus rankNimbostratus
    Jun 10, 2014

    Thanks Cory, thats one of the Manual Chapter i was reading :) i hope its true but i cant think of any reason why the key mismatch i see in the ACS log..

     

  • BMAN1_160384's avatar
    BMAN1_160384
    Icon for Nimbostratus rankNimbostratus
    Jun 10, 2014

    Thanks, i will try to see how to configure the remote role. "The attribute string that you set within your BIG-IP remote role needs to be defined as a custom attribute under your ACS group" - i didnt understand this part but i guess i will when i see how to configure the remote role..

     

    • Cory_50405's avatar
      Cory_50405
      Icon for Noctilucent rankNoctilucent
      Jun 10, 2014
      The remote role setup is quite easy. ACS 4.2 was as well from what I recall. Feel free to post any further questions. I'll try to help out as best I can.