2.4.2 Set AAA 'source-interface'

Information

Force AAA to use the IP address of a specified interface for all outgoing AAA packets

Rationale:

This is required so that the AAA server (RADIUS or TACACS+) can easily identify routers and authenticate requests by their IP address.

Impact:

Organizations should design and implement authentication, authorization, and accounting (AAA) services for effective monitoring of enterprise network devices. Binding AAA services to the source-interface loopback enables these services.

Solution

Bind AAA services to the loopback interface.

Hostname(config)#ip radius source-interface loopback {loopback_interface_number}
or
Hostname(config)#aaa group server tacacs+ {group_name} hostname(config-sg-tacacs+)#ip tacacs source-interface {loopback_interface_number}

See Also

https://workbench.cisecurity.org/files/3762

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1), CSCv7|16.2

Plugin: Cisco

Control ID: 6e5b9c58da6580f8d46c707ae6909f3bed6ae97f4a7cdc2be1a8fad1a1f9c6d7