每個VRF TACACS+的IOS故障排除

簡介

TACACS+大量用作向網路裝置驗證使用者的身份驗證協定。越來越多的管理員使用VPN路由和轉發(VRF)來隔離管理流量。 預設情況下，IOS上的AAA使用預設路由表傳送資料包。本檔案介紹當伺服器位於VRF中時，如何設定TACACS+並疑難排解。

必要條件

需求

思科建議您瞭解以下主題：

• TACACS+

• VRF

採用元件

本文件所述內容不限於特定軟體和硬體版本。

慣例

如需文件慣例的詳細資訊，請參閱思科技術提示慣例。

功能資訊

實質上，VRF是裝置上的虛擬路由表。當IOS在功能或介面使用VRF時做出路由決策時，將根據該VRF路由表做出路由決策。否則，該功能將使用全域性路由表。考慮到這一點，以下是將TACACS+配置為使用VRF的方式（相關配置以粗體顯示）：

version 15.2
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname vrfAAA
!
boot-start-marker
boot-end-marker
!
aaa new-model
!
aaa group server tacacs+ management
 server-private 192.0.2.4 key cisco
 server-private 192.0.2.5 key cisco
 ip vrf forwarding blue
 ip tacacs source-interface GigabitEthernet0/0
!
aaa authentication login default group management local
aaa authorization exec default group management if-authenticated 
aaa accounting exec default start-stop group management
!
aaa session-id common
!
no ipv6 cef
!
ip vrf blue
!
no ip domain lookup
ip cef
!
interface GigabitEthernet0/0
 ip vrf forwarding blue
 ip address 203.0.113.2 255.255.255.0
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route vrf blue 0.0.0.0 0.0.0.0 203.0.113.1
!
line con 0
line aux 0
line vty 0 4
 transport input all

您可以看到，沒有全域性定義的TACACS+伺服器。如果要將伺服器遷移到VRF，可以安全地移除全域性配置的TACACS+伺服器。

故障排除方法

1. 請確保在aaa群組伺服器下具有適當的ip vrf轉送定義，以及用於TACACS+流量的來源介面。

2. 檢查vrf路由表，並確儲存在通往TACACS+伺服器的路由。上面的示例用於顯示vrf路由表：

   vrfAAA#show ip route vrf blue
   
   Routing Table: blue
   Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
          D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
          N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
          E1 - OSPF external type 1, E2 - OSPF external type 2
          i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
          ia - IS-IS inter area, * - candidate default, U - per-user static route
          o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
          + - replicated route, % - next hop override
   
   Gateway of last resort is 203.0.113.1 to network 0.0.0.0
   
   S*    0.0.0.0/0 [1/0] via 203.0.113.1
         203.0.0.0/24 is variably subnetted, 2 subnets, 2 masks
   C        203.0.113.0/24 is directly connected, GigabitEthernet0/0
   L        203.0.113.2/32 is directly connected, GigabitEthernet0/0

3. 是否能ping通TACACS+伺服器？請記住，這也需要特定於VRF:

   vrfAAA#ping vrf blue 192.0.2.4
   Type escape sequence to abort.
   Sending 5, 100-byte ICMP Echos to 102.0.2.4, timeout is 2 seconds:
   !!!!!
   Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

4. 您可以使用test aaa命令驗證連線（最後必須使用new-code選項，舊版不起作用）：

   vrfAAA#test aaa group management cisco Cisco123 new-code 
   Sending password
   User successfully authenticated
   
   USER ATTRIBUTES
   
   username             "cisco"
   reply-message        "password: "

如果路由已建立，而且您在TACACS+伺服器上沒有看到命中，請確保ACL允許TCP埠49從路由器或交換機到達伺服器。如果您遇到驗證失敗，請按正常方式疑難排解TACACS+，則VRF功能僅用於封包的路由。

資料分析

如果以上所有內容看起來都正確，則可以啟用aaa和tacacs調試來排除故障。從以下調試開始：

• debug tacacs

• debug aaa authentication

以下是偵錯範例，其中某些內容未正確設定，例如但不限於：

• 缺少TACACS+源介面

• 源介面下或aaa組伺服器下缺少ip vrf forwarding命令

• VRF路由表中沒有到TACACS+伺服器的路由

Jul 30 20:23:16.399: TPLUS: Queuing AAA Authentication request 0 for processing
Jul 30 20:23:16.399: TPLUS: processing authentication start request id 0
Jul 30 20:23:16.399: TPLUS: Authentication start packet created for 0(cisco)
Jul 30 20:23:16.399: TPLUS: Using server 192.0.2.4
Jul 30 20:23:16.399: TPLUS(00000000)/0: Connect Error No route to host
Jul 30 20:23:16.399: TPLUS: Choosing next server 192.0.2.5
Jul 30 20:23:16.399: TPLUS(00000000)/0: Connect Error No route to host

以下是成功連線：

Jul 30 20:54:29.091: AAA/AUTHEN/LOGIN (00000000): Pick method list 'default' 
Jul 30 20:54:29.091: TPLUS: Queuing AAA Authentication request 0 for processing
Jul 30 20:54:29.091: TPLUS: processing authentication start request id 0
Jul 30 20:54:29.091: TPLUS: Authentication start packet created for 0(cisco)
Jul 30 20:54:29.091: TPLUS: Using server 192.0.2.4
Jul 30 20:54:29.091: TPLUS(00000000)/0/NB_WAIT/2B2DC1AC: Started 5 sec timeout
Jul 30 20:54:29.095: TPLUS(00000000)/0/NB_WAIT: socket event 2
Jul 30 20:54:29.095: TPLUS(00000000)/0/NB_WAIT: wrote entire 25 bytes request
Jul 30 20:54:29.095: TPLUS(00000000)/0/READ: socket event 1
Jul 30 20:54:29.095: TPLUS(00000000)/0/READ: Would block while reading
Jul 30 20:54:29.099: TPLUS(00000000)/0/READ: socket event 1
Jul 30 20:54:29.099: TPLUS(00000000)/0/READ: read entire 12 header bytes (expect 16 bytes data)
Jul 30 20:54:29.099: TPLUS(00000000)/0/READ: socket event 1
Jul 30 20:54:29.099: TPLUS(00000000)/0/READ: read entire 28 bytes response
Jul 30 20:54:29.099: TPLUS(00000000)/0/2B2DC1AC: Processing the reply packet
Jul 30 20:54:29.099: TPLUS: Received authen response status GET_PASSWORD (8)
Jul 30 20:54:29.099: TPLUS: Queuing AAA Authentication request 0 for processing
Jul 30 20:54:29.099: TPLUS: processing authentication continue request id 0
Jul 30 20:54:29.099: TPLUS: Authentication continue packet generated for 0
Jul 30 20:54:29.099: TPLUS(00000000)/0/WRITE/2B2DC1AC: Started 5 sec timeout
Jul 30 20:54:29.099: TPLUS(00000000)/0/WRITE: wrote entire 25 bytes request
Jul 30 20:54:29.103: TPLUS(00000000)/0/READ: socket event 1
Jul 30 20:54:29.103: TPLUS(00000000)/0/READ: read entire 12 header bytes (expect 6 bytes data)
Jul 30 20:54:29.103: TPLUS(00000000)/0/READ: socket event 1
Jul 30 20:54:29.103: TPLUS(00000000)/0/READ: read entire 18 bytes response
Jul 30 20:54:29.103: TPLUS(00000000)/0/2B2DC1AC: Processing the reply packet
Jul 30 20:54:29.103: TPLUS: Received authen response status PASS (2)

常見問題

最常見的問題是配置。管理員多次放入aaa組伺服器，但不更新aaa行以指向伺服器組。而不是：

aaa authentication login default group management local
aaa authorization exec default group management if-authenticated 
aaa accounting exec default start-stop group management

管理員將：

aaa authentication login default grout tacacs+ local
aaa authorization exec default group tacacs+ if-authenticated 
aaa accounting exec default start-stop group tacacs+

只需使用正確的伺服器組更新配置即可。

第二個常見問題是使用者在嘗試在伺服器組下新增ip vrf forwarding時收到此錯誤：

% Unknown command or computer name, or unable to find computer address

這表示找不到該命令。如果發生這種情況，請確保IOS版本支援每個VRF TACACS+。以下是一些常見的最低版本：

• 12.3(7)公噸

• 12.2(33)SRA1

• 12.2(33)SXI

• 12.2(33)SXH4

• 12.2(54)SG

相關資訊

• 技術支援與文件 - Cisco Systems