Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance OpenConfig AAA Model to Support Multiple TACACS/RADIUS Servers with Shared IP Addresses and Distinct Ports #1198

Open
macb2625 opened this issue Oct 14, 2024 · 1 comment · May be fixed by #1105

Comments

@macb2625
Copy link

Description
The current OpenConfig AAA model specifies a single leaf for the address of authentication servers in the openconfig-aaa.yang file. This design restricts the ability to configure multiple TACACS or RADIUS servers that may share the same IP address but operate on different ports. Therefore, it is not possible to accurately represent configurations where multiple servers listen on the same IP address for different authentication and accounting purposes.

Problem Statement
In the existing model:

The address key is defined as a single IP address (oc-inet:ip-address), preventing the specification of port numbers as part of the key.


RADIUS servers utilize distinct ports for authentication (default 1812) and accounting (default 1813) and two or more server can be configured as fallback on same IP but with different acct and auth port.
TACACS servers can operate on different ports but may also share the same IP address.
As a result, configurations with the same address but different ports cannot be accurately represented, leading to potential conflicts and limitations.

@dplore
Copy link
Member

dplore commented Nov 1, 2024

fixed by #1105

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: No status
2 participants