Forum Discussion

amintej's avatar
amintej
Icon for Cirrus rankCirrus
Jan 10, 2017

Tacacs Remote address field not sent

Hello,

 

Our load balancers use Cisco ACS for authenticate network operators (TACACS protocol), some of the ACS policies are based on source IP. We realized Big IP is not sending Remote address Field, and that is why our ACS rules are not being applied. Any ideas for solving this problem ? Version: 11.4.1 - 647.0

 

BIG-IP
devops
security
tacacs
  • TayF5un's avatar
    TayF5un
    Icon for Nimbostratus rankNimbostratus
    Jan 10, 2017

    I think that, you have deployed F5 devices with one-arm mode so you could not see source ip.

     

  • Guillaume_H_'s avatar
    Guillaume_H_
    Icon for Nimbostratus rankNimbostratus
    Jan 11, 2017

    I think you can resolved this problem with an irules. you can add the remote address field in the payload.

     

  • matm_58717's avatar
    matm_58717
    Icon for Nimbostratus rankNimbostratus
    Feb 02, 2017

    Hi,

     

    I think not is possible with iRule, beacuse the iRule is associate a VS and TACACS service is to authenticate administrators users.

     

    The question is whether the F5 can be configured to allow the sending of the client's IP to the TACACS, I trying and the default behavior is that it does not send it.

     

    Best Regards

     

  • nizgeek_308659's avatar
    nizgeek_308659
    Icon for Nimbostratus rankNimbostratus
    Feb 02, 2017

    For Tacacs servers please add custom management route. It will resolve this issue. You may need to allow in firewalls the F5 management ip and Tacacs servers ips if there are any firewall in the path.