I want to send TACACS+ requests from Network Devices to an F5 VIP that will load balance several Cisco Identity Service Engine nodes that run the service.
Is there a configuration guide out there? The ISE portion is configured and work but when I point the TACACS+ AAA configuration on my network device to the F5 VIP I created, TACACS+ fails with a network device log entry; ex (ignore IPs)
Apr 11 2018 15:36:02 PDT: TAC+: Opened TCP/IP handle 0xFFB4E70CE0 to 126.96.36.199/49 using source 188.8.131.52 Apr 11 2018 15:36:02 PDT: TAC+: Opened 184.108.40.206 index=1 Apr 11 2018 15:36:02 PDT: TAC+: 220.127.116.11 (2473493593) AUTHOR/START queued Apr 11 2018 15:36:02 PDT: TAC+: (2473493593) AUTHOR/START processed Apr 11 2018 15:36:02 PDT: TAC+: received bad AUTHOR packet: type = 0, expected 2 Apr 11 2018 15:36:02 PDT: TAC+: Invalid AUTHOR/START packet (check keys). Apr 11 2018 15:36:02 PDT: TAC+: Closing TCP/IP 0xFFB4E70CE0 connection to 18.104.22.168/49
i am struggling with the same , even though SNAT Is disabled and i can clearly see the source : NAD device AND Destination : F5 VIP is getting trasnlated by F5 as source : NAD and Destination : One of the ISE Nodes.
aaa group server tacacs+ ISE_GROUP
server name F5-VIP
server name ISE-2
server name ISE-3
weird thing is , whenever i send traffic to F5 VIP for TACACS i dont see anything or logs on ISE too .I am not sure why ?
Can you suggest ?
Please can you share your inputs whether you are able to solve the issue . As I have configured same topology for ISE Nodes .
For your information , I have confiured VIP with standard Virtual server for port TACACS 49 port and associated backend ISE PSN Nodes for load balancing . I am going to test the device connection for TACACS using VIP ip address a AAA Server .
Please can you share your inputs if you tested AAA connection using TACACS .