Description

This article details how to troubleshoot TACACS+ on Junos since there is no operational command to verify the same. 

The article covers some of the preliminary steps that engineers/customers can start with, when troubleshooting a TACACS+ issue, including common TACACS+ authentication failures, validation of configuration, and monitoring to isolate the source of the issue.

Symptoms

Problems related to TACACS+ authentication

Solution

Topology

User_1 ----- > Device_1(10.10.10.1) ------ > Tacacs server (10.10.10.254)

When troubleshooting TACACS+ issues on Junos, before initiating the SSH connection from User_1 to Device_1 , check the following:

  • Check basic configuration:  

See TACACS+ Authentication in the User Access and Authentication Administration Guide for Junos OS.

Example Configuration

set system tacplus-server 10.10.10.254
set system tacplus-server 10.10.10.254 secret Tacacssecret1 
set system tacplus-server 10.10.10.254 source-address 10.0.0.1 
set system authentication-order [tacplus password]
set system login user remote class operator

  • Check basic connectivity to the server:

    • Initiate ICMP: ping 10.10.10.254

    • If ICMP is blocked, try using telnet to make sure that the port is open. 

      • telnet 10.10.10.254 22 / telnet 10.10.10.254 49
    • Check for high CPU / DDOS / system connections / core dumps / logs. 
show system processes extensive | except 0.00
show ddos-protection protocols violations
show system connections | match 22
show system connections | match 49
show system core-dumps
show log messages | match auth

  • Verify if there are any firewall filters blocking the TACACS port (49) or SSH (49) to Device_1.

show configuration firewall

  • Verify the shared secret password on the switch and server ends. If the authentication issue persists, change the shared secret password.

set system tacplus-server <tacplus-server-ip> secret <new-shared-secret>

  • Enable traceoptions for general authentication and check for errors.

See Tracing General Authentication Service (authd) Events for Troubleshooting in the Broadband Subscriber Sessions User Guide for more information. 

set system processes general-authentication-service traceoptions flag all
set system processes general-authentication-service traceoptions file tacacs-traceoptions




  • 

    Check the tcpdump on the authenticator switch:
    

    • 

      Initiate an SSH connection from the test User_1 to Device_1, which is facing the uplink interface to the server to monitor TACACS+ requests. 
      

    • 

      On Device_1:
      

      • 

        > monitor traffic interface <interface> size 1000 no-resolve write-file /var/tmp/Device_1.pcap
        

      

    • 

      If possible, capture these details on the TACACS server side as well when initiating the SSH connection from User_1 to Device_1. Perform the capture simultaneously.
      

    



Note: Check for TCP retransmissions/Dup ACK / TCP_SYN_RST / SYN.


Make sure that the TACACS server is properly configured.


If none of the above troubleshooting steps help to isolate the issue, open a Technical Support case for further troubleshooting.
Modification History
2024-11-25 : Article Created


2025-02-24 : Article modified (Verify the shared secret Password on both the switch and server ends. If the authentication issue persists, change the shared secret password.)


2026-08-10: Minor, non-technical changes made as part of content optimization for SEO