Match different AAA Groups per source IP

Question

Dear Colleagues,
 The issue that Im facing right now is the following:
  I have an external device that run auto-commissioning on my router and doesn't support "username" loggin, only "password" when attempt to loggin through telnet in order to access and run the script. In addition I have AAA TACACs running on the same router so this device is unable mow to access to the router as the first loggin request is the "username". I can not change the telnet command executed by the external device, its doing a single telnet to the destination IP of my router so I discard any option like adding a TCP port dedicated for this external device access.  To be clear, what is expecting to receive after execute the telnet is:
c:/> telnet 1.1.1.1
Trying 1.1.1.1...
Connected to 1.1.1.1.
Escape character is '^]'.
User Access Verification
Password:
 To fix this issue my idea is try to configure two different AAA groups, one AAA_GROUP that request normal authentication to TACACs for all telnet session and one EXCEPTION with authentication "none" and exec "local". The configuration should be something like this:
aaa new-model
aaa group server tacacs+ AAA_GROUP
 server-private A.B.C.D key 7 ###################
 ip tacacs source-interface Loopback0
aaa authentication login default group AAA_GROUP local
aaa authentication login EXCEPTION none
aaa authentication enable default group AAA_GROUP enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group AAA_GROUP local 
aaa authorization exec EXCEPTION local 
aaa authorization commands 15 default group AAA_GROUP none 
aaa accounting exec default start-stop group AAA_GROUP
aaa accounting commands 15 default stop-only group AAA_GROUP
aaa accounting connection default stop-only group AAA_GROUP
aaa accounting system default start-stop group AAA_GROUP
aaa session-id common
 Then match in some way all telnet session with source IP of the external device with the group EXCEPTION and the rest with AAA_GROUP. Finally, configure only a  "password" in the VTY lines so when the device attempt to loggin in the group EXCEPTION with no authentication and loggin local will be just requested to set the "password".
 The main issue is do this AAA groups discrimination between AAA_GROUP and EXCEPTION lists per source IP of the host originating the telnet session to my router.  Is that possible?
Thanks in advance for your support.

Answer 1

Hi,
problem is in you config, both class are pointing to same VIP and PORT, so first class will be only HIT.
try this confgiuration
policy-map type loadbalance first-match NON_AUTHENT_PM
  class NON_AUTHENT_CM   --------for desired client source IP's
    serverfarm PROXY_HTTP_SF
    nat dynamic 6 vlan 1601 serverfarm primary
  class class-default    ------for rest of client IP's
    serverfarm PROXY_HTTP_SF
    nat dynamic 5 vlan 1601 serverfarm primary
and remove NAT from multi-match policy. use single class, so rest of config will be
serverfarm host PROXY_HTTP_SF
  description Proxied Internet Connections
  probe PROXY_HTTP_PROBE
  fail-on-all
  rserver ELFCPRXY1
    inservice
  rserver ELFCPRXY2
    inservice
  rserver ELFCPRXY3
    inservice
class-map match-any NONAUTHENT_HTTP_VIP
  3 match virtual-address 10.10.240.5 tcp eq 80
class-map type http loadbalance match-any NON_AUTHENT_CM
  description Subnets from which Internet Authentication is not Required
  3 match source-address 10.10.16.0 255.255.240.0
  4 match source-address 10.10.32.0 255.255.240.0
  5 match source-address 10.10.48.0 255.255.240.0
policy-map type loadbalance first-match NON_AUTHENT_PM
  class NON_AUTHENT_CM
    serverfarm PROXY_HTTP_SF
    nat dynamic 6 vlan 1601 serverfarm primary
  class class-default
    serverfarm PROXY_HTTP_SF
    nat dynamic 5 vlan 1601 serverfarm primary
policy-map multi-match LOAD_BAL
  class NONAUTHENT_HTTP_VIP
    loadbalance vip inservice
    loadbalance policy NON_AUTHENT_PM
    loadbalance vip icmp-reply
Hope this help