Description

Audience: Network engineers operating Junos devices integrating with TACACS+/ISE.

This KB explains how Junos selects source IPs for TACACS and how to reliably force a specific interface/IP while keeping set system default-address-selection enabled.

Overview

TACACS+ servers often bind client devices (NADs) by source IP. In Junos, set system default-address-selection prefers loopback for management-plane traffic. 
When you need TACACS to source from a specific SVI/IRB or routed interface (e.g., a management VLAN) while retaining loopback preference for other services, use per-service source-address under TACACS configuration and ensure routing aligns.

 

Without Per-Service Source

Management-plane traffic (including TACACS) may source from loopback due to default-address-selection, which can cause TACACS authentication/accounting to be rejected by ISE expecting a different NAD IP.

 

With Explicit TACACS Source

TACACS authentication and accounting explicitly source from the desired interface IP (e.g., IRB.X), while other management traffic (NTP, DNS, syslog, SNMP) continues to prefer loopback.

 

 

 

 

Symptoms

How Junos Chooses Source Addresses (Concepts)

 

  • default-address-selection: Prefers loopback (lo0) for locally-originated traffic when multiple local addresses are eligible.

  • Per-service source-address: An explicit override under a service (e.g., TACACS) that selects a specific local IP for that service’s packets.

  • Routing path dependency: The chosen source must be valid on the egress routing path. If the route to the TACACS server exits via a different interface, policy/routing must still allow the selected source.

  • Accounting vs Authentication: TACACS accounting often uses a separate configuration stanza. Both must be pinned to the same source if the server expects a single NAD IP.

Solution

Configuration Patterns (Junos)

1) TACACS Authentication: source-address override

 
set system tacplus-server 192.0.2.10 secret "<shared-key>" set system tacplus-server 192.0.2.10 source-address 198.51.100.5 set system tacplus-server 192.0.2.20 secret "<shared-key>" set system tacplus-server 192.0.2.20 source-address 198.51.100.5
 

Replace 198.51.100.5 with the desired interface IP (e.g., IRB.X).

 

2) TACACS Accounting: align source-address

 
set system accounting events login set system accounting destination tacplus server 192.0.2.10 secret "<shared-key>" set system accounting destination tacplus server 192.0.2.10 source-address 198.51.100.5 set system accounting destination tacplus server 192.0.2.20 secret "<shared-key>" set system accounting destination tacplus server 192.0.2.20 source-address 198.51.100.5
 

3) Keep default loopback preference globally

 
set system default-address-selection
 

This preserves loopback preference for other services; TACACS is explicitly pinned by the service-level override.

Extended Solution

The root cause is the interaction between set system default-address-selection and the explicit source-address under your tacplus-server configuration.


Validation Checklist

  • Confirm the desired interface/IP is configured and up (e.g., show interfaces terse | match <IP>).
  • Verify routes to TACACS servers (show route <server-ip>) and ensure reachability with the chosen source.
  • Confirm configuration inheritance if using groups (show configuration system | display inheritance).
  • Test authentication path (test system authentication-server tacplus) and observe source IP on TACACS/ISE.
  • Test accounting events (login/logout) and verify source IP parity with authentication.
  • Ensure the TACACS/ISE NAD entry includes the selected source IP and correct shared secret.

 

Good Practises

 

  • Use a dedicated, routed management SVI for AAA, and register that IP on TACACS/ISE.

  • Retain default-address-selection for operational resilience; the loopback remains the stable source for other services.

  • Keep authentication and accounting server lists symmetrical (same servers, same source, same keys).

  • In multi-VRF designs, configure TACACS per routing-instance or use routing-instance-aware AAA if available; ensure routes and policies align with the selected source.

  • Document the intended source IP in your standard templates to avoid drift during changes.

 

Modification History

21st May-2026

Related Information

TACACS UI Configuration
https://mistsys.atlassian.net/wiki/spaces/CSQA/pages/2366834229/TACACS+UI+Configuration

 


Multiple Routing Instance
Routing instance configuration relevant to TACACS VRF-aware setups
https://mistsys.atlassian.net/wiki/spaces/CSQA/pages/1894219781/Multiple+Routing+Instance