Accessing SSL Visibility when TACACS+ has misconfigured private key.

Products

• SSL Visibility Appliance Software

Issue/Introduction

Access to SSL Visibility with remote TACACS+ authentication is not working properly due to a misconfiguration of the private key.  The connection to TACACS+ server is working properly, however, since the key is misconfigured authentication is broken.  This means that when a user is logging into the box, authentication doesn't work.  Since TACACS+ is configured a user will not be able to get into the box.  The only way local authentication will work is if the connection to the TACACS+ server is unavailable.

Environment

SSL Visibility configured with TACACS+ authentication is broken.

Cause

The connection to TACACS+ server is working properly, however, since the key is misconfigured authentication is broken.  This means that when a user is logging into the box, authentication doesn't work.  The only way local authentication will work is if the connection to the TACACS+ server is unavailable.

Resolution

Login capability can be restored if the administrator has console access to the box.  Log into the console, input the enable password, enter config mode.  Run the command remote-auth disable.  This will disable remote authentication allowing the admin to log in locally.  After logging in locally the admin can edite the TACACS+ private key and re-enable remote-auth.  An example of this is below:

sslv> en
Password:
sslv# config
Enter configuration commands, one per line. End with CNTL/Z.
sslv(config)# remote-auth ?
Possible completions:
  disable   Disable remote authentication
  <cr>
sslv(config)# remote-auth disable
Remote authentication is disabled
sslv(config)#