Auth succeeds but accouting returns Illegal packet (version=0xc0 type=0x03)

[victor ostorga]

Good day.

Trying to figure this out, requesting for your help:

Authentication and authorization works properly, but accounting is returning "Illegal packet (version=0xc0 type=0x03)".

Captures of the trace in the failing scenario are as follows:

Accounting request:

Accounting response:

Checking against a working accounting device, I've noticed the difference in the 'Auth Method' in accounting request.

A working accounting has

Auth Method: TACACSPLUS (0x06) 

non working accounting

Auth Method: NONE (0x01) 

Could that be the reason the accounting is failing?

kind Regards,

[Event-Driven Servers]

Hi

,

"Illegal packet" implies that there's a mismatch in packet length. Looking at the Wireshark output:

9 (header, flags to arg_cnt)

2 (arg_X_len)

14 (user)

3 (port)

12 (rem_addr)

9 (arg 1)

13 (arg 2)

This sums up to 62 bytes. However, the "packet length" from your TACACS+ header specifies 63. The packet is malformed

Cheers,

Marc