Invalid TACACS Logins from Outside

[ErikMarschang]

Just setup TACACS authentication using Cisco ISE as our TACACS server.  We can successfully login with our AD accounts, but when I look in the TACACS logs on ISE, I see a ton of "INVALID" attempts from external IPs.  Is the normal/expected?  Is there a way to just limit TACACS to our internal network?

[bafergel]

Hello @ErikMarschang, you can limit the permitted IPs to the management interface to an RFC 1918 address. Device>Setup>Interfaces>Management>Permitted IP Addresses.

[TomYoung]

He @ErikMarschang ,

That is not normal or expected.  If you setup TACACS+ for authentication into your NGFW, you should only see requests from the management interface of the NGFW.

Maybe you have a security rule allowing TACACS+ from the outside?  You could check the traffic logs.

Thanks,

Tom

[ErikMarschang]

Thank you confirming that its not normal.   That was my initial thought, but I am fairly new to the Palo NGFWs.  I will check the logs and see what I can find.

[ErikMarschang]

I was looking in the logs on the Palo.  I dont see anything in the Palo traffic logs regarding TACACS.  So maybe the attempts arent coming from the outside...  When I look ISE TACACS live logs, its full of "username INVALID".  Its almost like something from the Palo is constantly trying to login via TACACS... Not sure exactly, im still digging in.

[OtakarKlier]

Hello,

Also make sure your external interface does not allow logings from IP's you dont have listed. Something like:

I only allow ssh connections to my untrusted interface from the secondary data center. And in the secondary data center firewall I only allow SSH connections to the untrust interfaces from the primary data center. 

This example is just in case you lose the internal management for other device failures.

Cheers!

[ErikMarschang · Accepted solution]

It looks like I may have resolved my own issue.  Under Authentication Profile, someone had "all" listed in the allow list.  I removed "all" and added the specific admins that will administer the firewall.  Once committed, the ISE logs stopped filling up.  Thanks for chiming in everyone!