Troubleshooting guide for TACACS+ Authentication Fails on Omada Switch

Contents

Objective

If you encounter the issue of devices being unable to authenticate successfully after configuring the TACACS+ feature on the Omada Switch, you can follow the troubleshooting steps below to resolve the problem.

Requirements

Omada Smart, L2+ and L3 switches
Omada Controller (Software Controller / Hardware Controller / Cloud Based Controller, V5.9 and above)

Introduction

To enhance network security, you can configure TACACS+ authentication to restrict client access to the switch through the SSH protocol or Console interface. The topology of TACACS+ authentication, including Client/Switch/ TACACS+ Server.

Troubleshooting Steps

Step 1. Check the network connectivity.

Ensure the network link between the switch and the TACACS+ Server is normal, and also ensure that the authentication port (usually 49, but there are exceptions) is enabled by the TACACS+ Server.

Step 2. Check that the username and password used for authentication are correct.

Step 3. Check the configurations of TACACS+ Server and AAA.

Go to Tools > Terminal, select Switch as the Device Type, select the switch that has TACACS+ configured, and then click Open Terminal.

The position to open Switch terminal on Controller.

Use the following command to view information about the configuration:

Switch>en

Switch#show run

Input shows run command on terminal; firstly, you should enter in to enter command mode.

Find the following configuration information related to TACACS+ Server and AAA. Make sure that the IP address, port number, and key of the TACACS+ Server are correct. "test" is a custom login method that specifies TACACS+ authentication as the first priority.

Check information related to TACACS+ Server, here focus on IP address, port number, and key.

Find the following configuration information and make sure that the authentication method for SSH/Console login is specified as “test”.

Check the authentication method.

Note: The switch is not accessible using telnet after being adopted by Contrller.

Step 4. Check if ACL, IMPB, MAC Filtering, or other security policies are configured.

Conclusion

We have now completed the troubleshooting of TACACS+ authentication failure.

Get to know more details of each function and configuration please go to Download Center to download the manual of your product.