On 01/11/2010 18:43, David Rothera wrote: > You could configure an ACL to block access to the TACACS server on an > upstream device and then test?
typically you will need to test two scenarios: 1. the tacacs daemon being down, resulting in TCP RSTs being sent to the router/switch, and 2. the tacacs server being completely unavailable (sending nothing in return). Adding in "local" (or "line" on IOX) as an aaa authentication method will usually deal with this. If you're using authorization, you'll also need to create a DR procedural note to permit authorization to be disabled if the tacacs server is completely unavailable, and to document how to do this on whatever device. Otherwise you need to wait for a TCP timeout every time you issue a command. This can be teeth-gnashingly frustrating when dealing with service outages (i.e. think: 02:00am, tired, service down, can't browse internet to check the exact command, your manager shouting at you, and to top it all off, each command takes 20 seconds to execute). Nick _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
