Forum Discussion
TACAS not working - No TACACS packets in TCPDUMP
I'm not sure how far you got with this but it appears that TACACS traffic will not go out the mgmt interface (it is using the client side (vip) interface on my test units). I haven't found any way to force it to use mgmt, assuming it is possible.
- Adriano_BezerraMay 10, 2018Altostratus
For the traffic is the interface for the interface for rotations to manage servers to TACACS.
For Example:
sys management-route TACACS-1 { gateway 10.24.131.1 network 192.168.134.206/32 } sys management-route TACACS-2 { gateway 10.24.131.1 network 10.51.10.68/32 }
- Christopher_NoyMay 10, 2018Nimbostratus
I had static route entries added for the tacacs server under sys management-route, but it appears that BigIP won't even attempt to use the management interface (I suspect that the management interface is not a part of the logical BigIP network, since it doesn't show up in the list of vlans and interfaces under "network".
- Adriano_BezerraJun 01, 2018Altostratus
The management interface is Out-of-band, you can not see it in the graphical interface.
To identify the correct interface, access via SSH and enter the command "ifconfig" in bash, the management is usually ETH0, check and see if the displayed IP is the same as the one used to access the BIG-IP.
The ideal is to leave a capture running while trying to access the BIG-IP via TACACs, to see what are the IPs of the TACACs, with the command "tmsh list auth tacacs"
Example:
root@(bigip-lb01) (cfg-sync Standalone) (Active) (/ Common) (tmos) list auth tacacs auth tacacs system-auth { authentication use-all-servers debug enabled ip protocol secret $M$Ju$LSrECPSSDDDDTfb0HDmgJ2Dj50Q == servers *{10.1.1.230}* service ppp }
Do both captures at the same time.
tcpdump -nni eth0 10.1.1.230 << This for capturing in the management interface tcpdump -nni 0.0 10.1.1.230 -e << This for capturing at data traffic interfaces
Forward the result after the test.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com