TACACS authentication with Cisco ISE not working

[fhassan]

Hello, I would like to ask currently I have two firewall that needs to be configure TACACS. One of the firewall is working fine and I'm able to login using my credentials from ISE. However, another firewall is not working for the TACACS authentication. I have followed the same steps based on the working firewall.

Below here is the error I got when doing the test command:

xx@Txx> test authentication authentication-profile Tacacs_auth_profile username xxxx password
Enter password :

Target vsys is not specified, user "xxxx" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication request...
name "xxxx" has exact match in allow list

Authentication to TACACS+ server at '10.x.x.x' for user 'xxxx'
Server port: 49, timeout: 5, flag: 0
Egress: 10.x.x.x
Attempting CHAP authentication ...
CHAP authentication request is created
Sending credential: xxxxxx
Failed to send CHAP authentication request: connect: timed out

Returned status: -1
Authentication/authorization failed against TACACS+ server at 10.x.x.x for user Axxx

Appreciate the help on how I can troubleshoot this issue.

[BPry]

@fhassan,

Are these firewalls independent or part of an active/passive setup? If part of an active/passive pair, do you utilize the MGMT interface or do you have a service route configured to utilize a dataplane interface?

If these are standalone make sure that ISE is actually accepting connections. Your error message indicates you aren't getting a return; I'm pretty sure that ISE won't respond to requests if the source address isn't included as a network device, so you'd want to check that the ISE side of this configuration is actually correct.