How to troubleshoot problems with TACACS+

In this topic, you will learn how to troubleshoot typical problems with the operation of the Portnox™ TACACS+ service.

Access Alert: TACACS+ access attempt denied due to wrong credentials but credentials are correct. Alert occurs when using Cisco Nexus 9000 (may also occur on other NX-OS devices), and when using a Portnox account but LDAP-based accounts work correctly.

Remove the following command from switch configuration:

tacacs-server directed-request

If you enable the directed-request option, Cisco devices with the NX-OS operating system use only the TACACS+ method for authentication and not the default local method.

For more information, see: Cisco documentation.

Access Alert: TACACS+ authentication attempt denied due to MFA verification failure. Entra ID user must perform MFA to access, or TACACS+ server logs include: Authentication request returned error and limit reached for account.

Consider the following resolution options:

Also, check your TACACS+ license for potential expiration.

Access Alert: TACACS+ service connection not allowed for the account. Alert occurs when using Juniper switches.

The switch configuration includes an explicit definition of service-name, but this name is not configured in the Portnox TACACS+ policy. Instead, the policy only includes the default service name junos-exec.

Example of an explicit definition of service-name:

show configuration | display set | match portnox
                        set system tacplus-options service-name Portnox

Solution:

  1. Follow the steps in this topic to edit the TACACS+ authorization policy: Create or edit a TACACS+ authorization policy.

  2. Add the explicitly defined service name to the Allowed services list.

For more information, see Juniper documentation.

Access Alert: TACACS+ authentication attempt denied due to missing TACACS+ policy mapping. Users cannot log in to some NAS devices or can only login to NAS devices under a parent site.

The TACACS+ policy is incorrectly configured.

Sites do not support inheritance. Only parent-child relationships between sites are supported but not parent-child-grandchild relationships.

Solution:

  1. Follow the steps in this topic to assign TACACS+ policies to devices: Assign policies to a group.

  2. Use the OR element to specify multiple Site > Name > Equals conditions.

Access Alert: TACACS+ authentication attempt denied due to missing TACACS+ policy mapping. The TACACS+ server is deployed in a cloud environment (e.g. AWS, Azure), and is behind a load balancer.

The public IP addresses of the load balancer are unknown to Portnox Cloud.

Solution:

  1. Follow the steps in this topic to assign TACACS+ policies to devices: Assign policies to a group.

  2. Use the OR element to specify multiple NAS > IpAddress > Equals conditions with the public IP addresses of the load balancer.

Access Alert: TACACS+ authentication attempt denied due to MFA timeout. The group uses AgentP for MFA, and AgentP doesn’t receive the MFA request.

Configure the firewall for AgentP connections (see the following topic: How to set up the firewall for AgentP to connect to Cloud).

Access Alert: TACACS+ authentication attempt denied due to MFA timeout. The group uses Okta for MFA, and no push notification appears in Okta Verify.

TACACS+ MFA with Okta works only with Okta Verify push notifications. In the Okta Admin Console, open the settings of the Okta Verify authenticator. Make sure that Push notification (Android and iOS only) is selected as a verification option.

Access Alert: TACACS+ authentication attempt denied due to MFA timeout. The user receives the MFA request in AgentP, Okta Verify, or Cisco Duo but can’t confirm it before the attempt times out.

Check the following timeout values:

  • The Push-to-access notification timeout in the group settings. Select a longer value if users need more time (see the following topic: Edit and configure a group).

  • The TACACS+ timeout on the NAS device. Set it to the same value as the Push-to-access notification timeout (see the following topic: Configure NAS devices to access the TACACS+ server). For the exact command, consult the documentation of your NAS device.

A short NAS timeout may also cause errors in the logs, such as Invalid Client information received as input or Session closed.

Access Alert: TACACS+ authentication attempt denied due to MFA verification failure. Account is not a Cisco Duo account and cannot be verified by Cisco Duo.

The user doesn’t exist in Duo, or the Duo username doesn’t match the TACACS+ username. Add the user to Duo with exactly the same username, for example kosh@vorlon.com (see the following topic: Use Cisco Duo for TACACS+ MFA).

A Fortinet NAS user receives elevated privileges, even though they are assigned to a low-privilege group in Portnox Cloud.

Fortinet doesn’t rely on standard attributes, such as priv-lvl, to control admin access. Instead, it uses specific vendor-specific attributes (VSAs) like admin_prof or memberof to map users to admin profiles, and if those attributes aren’t included in the policy, users may end up with more access than intended.

Solution:

  1. Follow the steps in this topic to edit the TACACS+ authorization policy: Create or edit a TACACS+ authorization policy.

  2. Add fortigate to the Allowed services list.

  3. Add relevant admin_prof and/or memberof attributes to the Custom attributes list.

    For example:

    • admin_prof=User-RO-Profile
    • memberof=Fortigate-User-RO-Group
After switching Cisco ACI APICs to Portnox TACACS+ authentication, users can log in, but the ACI GUI loads with missing tabs, buttons, and features, suggesting incomplete privileges, while SSH access works normally.

The TACACS+ authorization policy for the Cisco ACI NAS is missing a required custom attribute. Without this attribute, the ACI GUI does not grant full access even though the user authenticates successfully.

Solution:

  1. Follow the steps in this topic to edit the TACACS+ authorization policy: Create or edit a TACACS+ authorization policy.

  2. Add shell:domains=all/admin/ to the Custom attributes list.

For more information, consult Cisco documentation.

Portnox Cloud successfully receives TACACS+ accounting logs (for example, login and logout events) from Cisco NAS devices, but it does not show any executed commands (such as show or configure) in the logs or alerts.

By default, Cisco devices only send command accounting data to the TACACS+ server for privilege levels that are specifically set. If a user logs in at a level (0, 1, or 15) that has no accounting enabled, command execution will not be recorded, even if session accounting works.

To fix this, add AAA command accounting in the switch TACACS+ configuration.

Example: enable command accounting for privilege level 15 (full admin) with this command:

aaa accounting commands 15 default start-stop group tacacs+
Most TACACS+ NAS devices show Unknown as the vendor in Portnox Cloud, and the device name defaults to the IP address of the NAS.

For RADIUS-based NAS devices, Portnox Cloud uses several mechanisms to identify the vendor and model of a device, including the OUI (the first three bytes of the MAC address) and DHCP fingerprinting. For more information, see: How does Portnox Cloud know the device make/model?. TACACS+ packets do not contain the MAC address of the NAS or any DHCP information, so none of these mechanisms are available. Because of this, Portnox Cloud cannot automatically identify the vendor or name of a NAS device using the TACACS+ protocol alone.

If needed (for example, for filtering), configure the Display name field of the NAS device manually, and include the vendor name as part of the value.