nerdexam
Cisco

300-715 · Question #292

A network engineer has recently configured a remote branch router to authenticate to a centralized Cisco ISE server behind the corporate firewall using TACACS+. After making this configuration…

The correct answer is B. The tacacs source-interface command on the router references the wrong interface. The most likely cause of failed TACACS+ logins, where other traffic reaches ISE but TACACS+ does not, is an incorrect tacacs source-interface configuration on the router.

Network Access Device Administration

Question

A network engineer has recently configured a remote branch router to authenticate to a centralized Cisco ISE server behind the corporate firewall using TACACS+. After making this configuration change, the engineer opened another SSH session to the router in order to verity that login attempts are now being sent to Cisco ISE, however that login attempt was unsuccessful. There are no connection attempts showing in the TACACS live log in Cisco ISE and the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic. Which misconfiguration is the cause of the failed login?

Options

  • AThe router is missing a route to the Cisco ISE server.
  • BThe tacacs source-interface command on the router references the wrong interface.
  • CNo hosts have been defined under the aaa server group on the router.
  • DThe shared secret entered on the router for the Cisco ISE server is incorrect.

How the community answered

(35 responses)
  • A
    20% (7)
  • B
    63% (22)
  • C
    6% (2)
  • D
    11% (4)

Why each option

The most likely cause of failed TACACS+ logins, where other traffic reaches ISE but TACACS+ does not, is an incorrect `tacacs source-interface` configuration on the router.

AThe router is missing a route to the Cisco ISE server.

If the router was missing a route to the Cisco ISE server, then no traffic, including syslog and SNMP, would reach ISE.

BThe tacacs source-interface command on the router references the wrong interface.Correct

If syslog and SNMP traffic reaches the Cisco ISE server but TACACS+ traffic does not, and no TACACS+ attempts appear in ISE's live logs, it strongly indicates that the router is sourcing TACACS+ packets from an unexpected or unroutable interface. The `ip tacacs source-interface` command specifies which interface's IP address the router uses as the source for TACACS+ packets, and a misconfiguration here would prevent TACACS+ traffic from correctly traversing the network to ISE.

CNo hosts have been defined under the aaa server group on the router.

If no hosts were defined under the AAA server group, the router would not attempt TACACS+ authentication at all, but the scenario implies a login attempt was made.

DThe shared secret entered on the router for the Cisco ISE server is incorrect.

An incorrect shared secret would result in TACACS+ traffic reaching ISE and appearing in live logs, but the authentication attempt would fail, which contradicts the observation that no TACACS+ traffic is seen at the firewall or ISE.

Concept tested: Cisco IOS TACACS+ source interface configuration

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-mt/sec-aaa-15-mt-book/sec-cfg-tacacs-plus.html

Topics

#TACACS+#Router Configuration#Source Interface#AAA Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-715 Practice