Description

This article will help to troubleshoot Tacacs+ , since there is no operational command to verify Tacacs+ on JunOS.

This article convers some of the preliminary steps which engineers/customers can start with when troubleshooting a Tacacs+ issue. This will help validate the configuration and monitoring which will help isolate the source of issue.

Symptoms

Authentication issues

Solution

Brief topology:

User_1 ----- > Device_1(10.10.10.1) ------ > Tacacs server (10.10.10.254)

 

Before initiating SSH connection from User_1 to Device_1 , please check the following:

 

  • Check basic configuration:  

https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/user-access-tacacs-authentication.html#id-example-configuring-a-tacacs-server-for-system-authentication

 

Example configuration:

set system tacplus-server 10.10.10.254

set system tacplus-server 10.10.10.254 secret Tacacssecret1

set system tacplus-server 10.10.10.254 source-address 10.0.0.1

set system authentication-order [tacplus password]

set system login user remote class operator

 

  • Basic connectivity to the server.

-Initiate ICMP : ping 10.10.10.254

-If ICMP is blocked, try using telnet to make sure the port is open

telnet 10.10.10.254 22 / telnet 10.10.10.254 49

 

-Check if CPU high / DDOS / check system connections / core dumps / logs

show system processes extensive | except 0.00

show ddos-protection protocols violations

show system connections | match 22

show system connections | match 49

show system core-dumps

show log messages | match auth

 

  • Verify if there are any firewall filters blocking Tacacs port (49) or SSH (49) to the Device_1

show configuration firewall   

 

  • Verify the shared secret password on the switch and server ends. If the authentication issue persists, change the shared secret password.

set system tacplus-server <tacplus-server-ip> secret <new-shared-secret>

 

  • Enable traceoptions for general authentication and check for errors.

https://www.juniper.net/documentation/us/en/software/junos/subscriber-mgmt-sessions/topics/topic-map/general-authentication-service-events-tracing.html

set system processes general-authentication-service traceoptions flag all

set system processes general-authentication-service traceoptions file tacacs-traceoptions

 

  • Tcpdump on authenticator switch:

-Initiate the ssh connection from test User_1 to the Device_1 facing uplink interface to the server to monitor Tacacs+ requests.

On Device_1 -- > monitor traffic interface <interface> size 1000 no-resolve write-file /var/tmp/Device_1.pcap

 

-If possible, capture on the Tacacs server side when initiating ssh connection from User_1 to Device_1, please perform the capture simultaneously

Note: check for TCP retransmissions/Dup ACK / TCP_SYN_RST / SYN

 

  • Make sure the TACACS server is properly configured.

 

  • If none of the above troubleshooting help to isolate the issue, please open a Technical case with JTAC for further troubleshooting.

 

Modification History

2024-11-25 : Article Created

2025-02-24 : Article modified (Verify the shared secret Password on both the switch and server ends. If the authentication issue persists, change the shared secret password.)