Multiple key approach doesn't work

[Gabriel Wargo]

Hey, Marc!

I read your input on another thread how one can just configure two keys in parallel in the TacPlus-NG config file.
https://groups.google.com/g/event-driven-servers/c/QZ-2l-ISc1k/m/c2Ik9asYAQAJ

Here is what I have now:

    device global {
        address = 0.0.0.0/0
        key = oldkey
        #Current key
        key = newkey
        #New key for rollovers. Remove the old key once you're done rolling all devices over and then leave the new key blank until the next time.

Every time I try using my testing switch with the new key, I just get this error in the debug output:

127.0.0.1 port (unknown): Illegal packet (version=0xc0 type=0x01)

I made sure both my switch and the config file had the same keys, but for some reason, it will only work with the old key. The switch is a Cisco Catalyst 3750X if that helps.

What should I do here?

[Marc Huber]

Hi Gabriel,

I can't reproduce that behavior -- just added a couple more keys to one of my lab configs, and each one of the keys just worked.

Any special chars in the new key, perhaps? I assume that "oldkey" and "newkey" aren't the real keys you're using.

Cheers,

Marc

--
You received this message because you are subscribed to the Google Groups "Event-Driven Servers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to event-driven-ser...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/dd5d48cd-3322-4640-a124-7b1b0c086cfan%40googlegroups.com.

[Gabriel Wargo]

I tried them using only alphanumeric keys with no special characters and that did not work.

You received this message because you are subscribed to a topic in the Google Groups "Event-Driven Servers" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/event-driven-servers/K7t4KgLy_zo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to event-driven-ser...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/73f5883f-c069-43c2-8647-90454cd21ead%40googlemail.com.

[Marc Huber]

Hi Gabriel,

just tried the secondary-keys feature again, no issues, tested with varying key sizes.

Does Wireshark decoding confirm that the key the switch uses is one of your "oldkey"/"newkey" definitions, and does tac_plus-ng debug output show that the daemon tries all configured keys?

Cheers,

Marc

To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/CAAw9igD-ZvMYjT2HosDMaBbA7JfQg-8fZSXt_PjCMSjeQd91RQ%40mail.gmail.com.