Seeking help with setting up Cisco ASA 5500 as TACACS+ Client

[popasmuerf]

Hello,

I recently installed an ASA 5500. Everything is working fine except I am having trouble getting the ASA to see our TACACS+ server.

Here is the setup I currently have. Any help you guys could give would be greatly appreciated.

Thanks in advance....

Firewall# sh run | include aaa
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ (outside) host 10.0.0.10
aaa-server RADIUS protocol radius
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console TACACS+ LOCAL
aaa authentication serial console TACACS+ LOCAL
aaa authentication telnet console TACACS+ LOCAL
aaa accounting enable console TACACS+
aaa accounting serial console TACACS+
aaa accounting ssh console TACACS+
aaa accounting telnet console TACACS+
aaa accounting command privilege 15 TACACS+

 

[North323]

aaa-server TACACS+ (outside) host 10.0.0.10 I think this should be (inside) because your traffic is sourced from the inside and not the outside because your outside probably has a lower security (like 50 or 0) and your inside has like 100

 

[North323]

also looks like you are missing this line too:
aaa authorization command TACACS+ LOCAL

 

[tjbradford]

i know this sounds silly but does the tacacs+ server require you to grant the ASA to query it for tacacs infomation?

only permitted devices are able to do such things on well configured auth servers eg. RSA