System information

Troubleshooting TACACS+ and XTACACS
Book Title
24-478
Possible Problem Solution
Missing login tacacs command
Step 1 Use the show running-config privileged exec command on the router to
see whether the login tacacs line configuration command is present.
Step 2 If the command is not present, add the command on each line that should
use XTACACS. For example, to configure line 2 to use XTACACS, enter
the following commands:
C2500(config)#line 2
C2500(config-line)#login tacacs
For detailed information on configuring XTACACS, refer to the Cisco IOS
Configuration Fundamentals Configuration Guide and Configuration
Fundamentals Command Reference.
Router does not have minimum
XTACACS configuration
Step 1 Use the show running-config privileged exec command to view the local
router configuration. Look for the following commands:
tacacs-server host hostname
tacacs-server extended
where name is the DNS hostname or IP address of the XTACACS server.
Step 2 If these commands are not present, add them to the configuration.
Examples:
The following example enables Extended TACACS mode:
tacacs-server extended
The following example specifies a TACACS host named Sea_Change:
tacacs-server host Sea_Change
PPP not functioning correctly If PPP is not functioning properly, problems will occur when using XTACACS. Use
the debug ppp negotiation privileged exec command to see whether both sides are
communicating.
Caution: Because debugging output is assigned high priority in the CPU process, it
can render the system unusable. For this reason, use debug commands only to
troubleshoot specific problems or during troubleshooting sessions with Cisco
technical support staff. Moreover, it is best to use debug commands during periods
of lower network traffic and fewer users. Debugging during these periods decreases
the likelihood that increased debug command processing overhead will affect
system use.
For information on configuring PPP, refer to the Cisco IOS Configuration
Fundamentals Configuration Guide and Configuration Fundamentals Command
Reference.
PAP is misconfigured
Step 1 Use the show running-config privileged exec command to make sure the
router is configured for PAP authentication. The router configuration
should include the following interface configuration commands for each
async interface that should use PAP authentication:
ppp authentication pap
ppp use-tacacs
Step 2
If the commands are not present, add them to the configuration.
In the following example, asynchronous interface 1 is configured to use
TACACS for PAP authentication:
interface async 1
ppp authentication pap
ppp use-tacacs