[RADIATOR] Cisco NX-OS TACACS+ problems

[Caporossi, Steve G.]

We also have issues with NXOS; in our case using RADIUS.

It always seems to begin with these syslog messages;
2013 Oct 10 19:56:14.103 mdf1 %RADIUS-3-RADIUS_ERROR_MESSAGE: Failed looking up IP address for RADIUS server <server address>
2013 Oct 10 19:56:14.105 mdf1 %RADIUS-3-RADIUS_ERROR_MESSAGE: Failed looking up IP address for RADIUS server <server address>
2013 Oct 10 19:56:14.106 mdf1 %RADIUS-3-RADIUS_ERROR_MESSAGE: Failed looking up IP address for RADIUS server <server address>
2013 Oct 10 19:56:14.107 mdf1 %RADIUS-3-RADIUS_ERROR_MESSAGE: All RADIUS servers failed to respon
d after retries.

 Authentication fails and we to fallback to local authentication to "fix" the issue by sending test authentication to the RADIUS servers.

We have the DNS entries configured on the Nexus devices and when this is happening the device can ping the servers using the hostname. Another strange thing is it happens primarily in one VDC and much less frequently on the others using the same OOB management network.

Steve


On Oct 11, 2013, at 4:38 AM, Alexander Hartmaier <alexander.hartmaier at t-systems.at>
 wrote:

> Hi,
> our switching guys reported that their Cisco Nexus switches running NX-OS log that their can't reach the tacacs servers. This is what the troubleshooting brought up:
> 
> 2013 Oct 11 08:47:37.061 sgv20s %TACACS-3-TACACS_ERROR_MESSAGE: All servers failed to respond
> 
>  
> 149) Event:E_MTS_TX, length:60, at 60683 usecs after Fri Oct 11 08:47:37 2013
> 
>     [RSP] Opc:MTS_OPC_TACACS_AAA_REQ(8421), Id:0X0A287795, Ret:SUCCESS
> 
>     Src:0x00000501/112, Dst:0x00000501/111, Flags:None
> 
>     HA_SEQNO:0X00000000, RRtoken:0x0A287778, Sync:UNKNOWN, Payloadsize:26
> 
>     Payload:    
> 
>     0x0000:  01 03 01 00 3b a2 66 be 00 00 00 00 00 02 00 00 
> 
>  
>  
> 150) Event:E_MTS_RX, length:60, at 46447 usecs after Fri Oct 11 08:47:37 2013
> 
>     [REQ] Opc:MTS_OPC_TACACS_AAA_REQ(8421), Id:0X0A287778, Ret:SUCCESS
> 
>     Src:0x00000501/111, Dst:0x00000501/0, Flags:None
> 
>     HA_SEQNO:0X00000000, RRtoken:0x0A287778, Sync:UNKNOWN, Payloadsize:371
> 
>     Payload:    
> 
>     0x0000:  01 03 0c 00 00 00 00 00 00 00 00 00 00 00 02 00 
> 
> 
> According to Cisco the accounting responses from Radiator (version 4.11 with patches revision 1.1530) contain errors:
> 
> Accounting Statistics
> 
>         failed transactions: 1865
> 
>         successful transactions: 0
> 
>         requests sent: 1865
> 
>         requests timed out: 4
> 
>         responses with no matching requests: 0
> 
>         responses not processed: 0
> 
>         responses containing errors: 1861
> 
> 
> Did someone else notice these problems? Authentication works without any problems.
> 
> -- 
> Best regards, Alexander Hartmaier
> 
> T-Systems Austria GesmbH
> TSS Security Services
> Network Security & Monitoring Engineer
> 
> phone: +43(0)57057-4320
> fax: +43(0)57057-954320
> 
> 
> 
> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
> T-Systems Austria GesmbH Rennweg 97-99, 1030 Wien
> Handelsgericht Wien, FN 79340b
> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
> Notice: This e-mail contains information that is confidential and may be privileged.
> If you are not the intended recipient, please notify the sender and then
> delete this e-mail immediately.
> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
> _______________________________________________
> radiator mailing list
> radiator at open.com.au
> http://www.open.com.au/mailman/listinfo/radiator

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4433 bytes
Desc: not available
Url : http://www.open.com.au/pipermail/radiator/attachments/20131011/b9c4dcc4/attachment-0001.bin