TACACS+ timeout value ignored

I'm running ACS 3.3. I have a bunch of Catalyst 3550 and 3560 switches, some running IOS 12.1(19)EA1c and others running IOS 12.2(20)SE1.
All are configured for TACACS+ as follows:
aaa new-model
aaa authentication login default group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization exec default group tacacs+ if-authenticated none
aaa authorization commands 15 default group tacacs+ if-authenticated none
aaa accounting exec default stop-only group tacacs+
aaa accounting commands 15 default stop-only group tacacs+
aaa accounting system default stop-only group tacacs+
tacacs-server host 10.1.1.1
tacacs-server timeout 2
tacacs-server directed-request
tacacs-server key CISCO
All works fine however the "timeout" value above seems to be ignored on switches running 12.2(20)SE1. It should be that if the TACACS+ server (10.1.1.1) goes down, the switch will fall back to using local authentication after 2 secs. However, it seems to be fixed at 30 secs.
Note that it works fine on 12.1(19)EA1c but always seems fixed at 30 secs on 12.2(20)SE1. This makes it really annoying when TACACS+ is unavailable and you're trying to configure a switch, especially if you're doing command authorization.
Wondering if anyone else has this problem and whether Cisco is aware of it?
Thanks.
PAUL G.

You are possibly running into CSCed76124 - Tacacs-server timeout value ignored. I guess you will need to track it for a workaround or consider using another IOS version not affected with this defect.

Similar Messages

How do i set the timeout value?

I'm doing an insert...in the insert i have a trigger that fires a http put. when i'm doing a couple inserts at a time, it works fine. However if i try to insert about 50 at one time (within msecs of each other) then i get the following error:
ORA-29276 transfer timeout
Cause: Timeout occurred while reading from or writing to a network connection.
Action: Check the remote server or the network to ensure that it responds within the timeout limit. Or increase the timeout value.
My question is, how do i set this timeout value?

FYI,
IFS.PROTOCOLSERVER.SESSION.DEFAULT.Timeout
IFS.PROTOCOLSERVER.SessionStateTimeoutPeriod
IFS.PROTOCOLSERVER.SessionStateTimeoutPeriod
in cup server configuration

Possible to configure per connection timeout values?

hi,
please, does anybody know how (or whether or not it is even possible) to configure a "PER CONNECTION" timeout on the connections - created by jndi - to an ldap server?
my understanding is that setting the "com.sun.jndi.ldap.connect.timeout" property on the javax.naming.directory.InitialDirContext sets a _global_ timeout value for _all_ connections created/managed by that InitialDirContext (that is, with a "PER CONTEXT" scope).
however, what i would like to do instead, is somehow configure a different timeout value for each individual connection that a InitialDirContext might know about.
the first solution that will probably pop in your head is "connection pool". however, the app sets "java.naming.ldap.factory.socket" property to a custom socket factory class. according to the following paragraph from the jndi tutorial, that disqualifies the app from using connection pools:
"There are a couple of environment properties that automatically disqualify a Context instance from using a pooled connection. A Context instance cannot use a pooled connection if it has its "java.naming.ldap.factory.socket" property set to a custom socket factory class, or its "java.naming.security.sasl.callback" property set to a custom callback handler class, or its "com.sun.jndi.ldap.trace.ber" property set to enable protocol tracing."
http://java.sun.com/products/jndi/tutorial/ldap/connect/config.html
even if we could use connection pools, we still wouldn't be able to set "per connection" timeout values. would we?
one proposed solution is to completely rip out jndi from the app and replace it with the netscape directory sdk for java. to me, that seems like too drastic a measure though - given the project's time-constraints (the way the app was originally designed does not lend itself to a straight-forward "pop-out/drop-in" type replacement). i was hoping there would be a simpler alternative (a jndi-based configuration type solution, for example).
any suggestions would be gratefully appreciated. thanks in advance for your replies.

Enable the Default Host option in the AirPort Admin Utility, use the IP address you have assigned to your server.

Setting TCP Read timeout value?

How do I choose a timeout value for a TCP read function?
I'm receiving data from a server at a rate which varies between 40 and 140 Hz (normally 120 Hz), there is no handshaking and at any set transmission rate it appears that the network load causes the rate to fluctuate slightly.
All I have been able to do so far is plot a frame number that is received in my data and fiddle with the buffer mode and timeout until I get the least dropouts. At 120Hz 5ms works best with a standard buffer, surprisingly 8ms is poorer.
I am using a producer consumer loop with a queue and some interpolation to make up for the loss of data.
This is very hit and miss so I'm sure there's a proper / better way to do this!

If you are using standard mode, then the read function should return any partial data, but will report an error out.
You may want to look at the functions that you call after the TCP read. I think that the enqueue function will NOT enqueue data if there is an error in.
There is a function you can use to clear TCP timeout errors. You could use this to allow you to enqueue partial data to your consumer loop.
vi.lib\addons\internet\utils\tcputil.llb\No Time Out Error.vi
Note that it will be up to your consumer code to identify your 'frames' for proper decoding.
Now is the right time to use %^<%Y-%m-%dT%H:%M:%S%3uZ>T
If you don't hate time zones, you're not a real programmer.
"You are what you don't automate"
Inplaceness is synonymous with insidiousness

Can we set the query timeout value in a global control place?

hi everyone,
We use the FullTextSqlQuery class to do query stuff, but we have the query timeout issue, the query sometimes timeout, sometimes is normal. I know there is a property from Query class called Timeout, and the default
time is 15 seconds, but we have lots of code involving FullTextSqlQuery.
I want to know is there a gloabal place like the web.config or regedit or somewhere to set the timeout value?
Thanks

Did you ever get an answer? I'm in the same boat...the only way I can seem to not charge tax to my wholesale clients is to set "tax never applies". But I got over 300 products...how can I do it "en mass"???
Anybody??
I tried creating a special tax code at 0% but that didn't do it either.
thanks in advance,
Scot.

EIC Web Client Timeout value

Hello, I am trying to help our EIC users with a request. They say that the web client times out and closes on them after about 5 minutes of inactivity. They would like to increase the timeout value. Unfortunately the person who implemented this is no longer here and I am not finding a place to configure the timeout. Is this value configurable, and if so where? Thanks very much!

Hi Jim
There is no time out configuration values within EIC as it follows the overall SAP environment time out which is typically controlled by the basis team. If you are finding that EIC is timing out at a different schedule than production SAP they may be something custom that was built for your company that you will want to review.
Hope this helps.
Jarret

General query on CSM and CSS flow timeout values

Hi all,
i have a SLB Application Processor Complex module on my Cisco 6504 which basically does some load balancing work. I am pretty new to this device but the configurations and setup looks somewhat similar to the Cisco ACE but i only have some experience with the Cisco CSS.
What i would like to know is what the equivalent command to the CSS "flow timeout" is on the CSM. Would that be the "idle timeout" command? I understand that the "pending timeout" is more to governing how long it takes to setup a 3 way handshake from client to server and the "idle timeout" is what i am looking for. Please correct me if i am wrong...
On the CSS, a flow timeout is on 16secs for most standard ports and 8 secs for HTTP. I would like to know what the default setting is for the CSM idle timeout?? Thanks alot!!
Daniel

Hi Daniel,
For Idle Timeout the the default is 1 hour/ 3600 sec.
As you know for Cicso CSM thare are 2 timers per vserver.
Idle timeout
Pending timeout.
If a connection is timed out it's because of one of these timers.
Idle timeout per vserver - If there is no traffic neither from client nor server. Idle connection timer duration in seconds; the range is from 0 (connection remains open indefinitely) to 13500000. The default is 1 hour. If you do not specify a duration value, the default value is applied.
Examples
This example shows how to specify an idle timer duration of 4000:
Cat6k-2(config-slb-vserver)# idle 4000
Pending timeout per vserver - is the max time allowed to complete the 3-way handshake.The default is 30 sec.Range is from 1 to 65535. This is a SLB virtual server configuration submode command. The pending connection timeout sets the response time for terminating connections if a switch becomes flooded with traffic. If the 3-way handshake does not complete within this time, the connection is dropped.
The CSM expect to see 2-way traffic within the pending timeout. If no traffic is received from the server, the session is removed.
Examples
This example shows how to set the number to wait for a connection to be made to the server:
Cat6k-2(config-slb-vserver)# pending 300
These are not counted as failures.
A failure is when the server does not respond or respond with a reset.
The CSM can hold 1 million connections in memory at the max.
So, if you set the idle timeout to 10 hours, your max connection rate is 1 M / 10 * 3600 = ~250 conn/sec.
Assuming they would all be open and then idle.
When the number of pending connections exceeds a configurable threshold, the CSM begins using the SYN cookies feature, encrypting all of the connection state information in the sequence numbers that it generates. This action prevents the CSM from consuming any flow state for pending (not fully established) TCP connections. This behavior is fully implemented in hardware and provides a good protection against SYN attacks.
Generic TCP termination
Some connections may not require TCP termination for Layer 7 load balancing. You can configure any virtual server to terminate all incoming TCP connections before load balancing those connections to the real servers. This configuration allows you to take advantage of all the CSM DoS features located in Layer 4 load-balancing environments.
To select the traffic type and appropriate timeout value, use the unidirectional command in the SLB virtual server submode.
[no | default] unidirectional
some protocol automatically set the 'unidirectional' function.
For example : UDP.
You can see if a vserver is unidirectional or bidirectional by doing a 'sho mod csm X vser name detail'
When a virtual server is configured as unidirectional, it no longer uses the pending timer. Instead, the idle timer will determine when to close idle or errant flows. Because the idle timer has a much longer default duration than the pending timer, be sure to set the idle timer to an appropriate value.
Use the command "show module csm slot# stats" to get the details of connection.
The statistics counters are 32-bit. Totals are accumulated since the last time the counters were cleared.
Examples
This example shows how to display SLB statistics:
Cat6k-2# show module csm 4 stats
Connections Created:       180
Connections Destroyed:     180
Connections Current:       0
Connections Timed-Out:     0
Connections Failed:        0
Server initiated Connections:
      Created:0, Current:0, Failed:0
L4 Load-Balanced Decisions:180
L4 Rejected Connections:   0
L7 Load-Balanced Decisions:0
L7 Rejected Connections:
      Total:0, Parser:0,
      Reached max parse len:0, Cookie out of mem:0,
      Cfg version mismatch:0, Bad SSL2 format:0
L4/L7 Rejected Connections:
      No policy:0, No policy match 0,
      No real:0, ACL denied 0,
      Server initiated:0
Checksum Failures: IP:0, TCP:0
Redirect Connections:0, Redirect Dropped:0
FTP Connections:           0
MAC Frames:
      Tx:Unicast:1506, Multicast:0, Broadcast:50898,
          Underflow Errors:0
      Rx:Unicast:2385, Multicast:6148349, Broadcast:53916,
          Overflow Errors:0, CRC Errors:0
Table mentioned below describes the fields in the display.
Table for "show module csm stats" Command Field Information
Field
Description
Connections Created
Number of connections that have been created on the CSM.
Connections Destroyed
Number of connections that have been destroyed on the CSM.
Connections Current
Number of current connections at the time the command was issued.
Connections Timed-Out
Number of connections that have timed out, which can occur for the following reasons:
•connection has been idle (in one or both directions) for longer than the configured idle timeout.
•TCP connection setup not completed successfully.
Connections Failed
Number of connections failed because the server did not respond within the timeout period, or the server replied with a reset.
Server initiated Connections
Number of connections created by real servers, the number of current connections, and the number of connections that failed (because the destination is unreachable).
L4 Load-Balanced Decisions
Number of Layer 4 load-balancing decisions attempted.
L4 Rejected Connections
Number of Layer 4 connections rejected because no real server was available
L7 Load-Balanced Decisions
Number of Layer 7 load-balancing decisions attempted.
L7 Rejected Connections: Total
Number of Layer 7 connections rejected.
L7 Rejected Connections: Parser
Number of Layer 7 connections rejected because the Layer 7 processor in the CSM ran out of session buffers to save the parsing state for multi-packet HTTP headers. The show module csm tech-support proc 3 command will show detailed buffer usage.
L7 Rejected Connections: Reached max parse len
Number of Layer 7 connections rejected because the HTTP header in the packet is longer than max-parse-len. When a virtual server is configured with HTTP persistent rebalancing or cookie matching/sticky, the CSM must parse to the end of HTTP header. The default max-parse-len value is 2000 bytes.
L7 Rejected Connections: Cookie out of mem:
Number of Layer 7 connections rejected because of no memory to store cookies. When a virtual server is configured with cookie matching, the CSM must save the cookie contents in memory.
L7 Rejected Connections: Cfg version mismatch
Number of Layer 7 connections rejected because part of the request was processed with an older version of the configuration. This counter should only increase after configuration changes.
L7 Rejected Connections: Bad SSL2 format:
Number of Layer 7 connections rejected because the request is using an unsupported SSL format or the format is not valid SSL.
L4/L7 Rejected Connections
Number of Layer 4 and Layer 7 connections rejected for policy related reasons:
No policy: connection rejected because the request matched a virtual server, but this virtual server did not have a policy configured.
No policy match: connection rejected because the request matched a virtual server, but the request did not match any policy configured on the virtual server.
No real: connection rejected because no real server was available to service the request
ACL denied: connection rejected because a request matched a policy with a client-access-list entry and the entry is configured to deny the request.
Server Initiated: connection initiated by a real server is rejected.
Checksum Failures
Number of checksum failures detected (there are separate counters for IP and TCP failures).
Redirect Connections
Number of connections redirected, and the number of redirect connections dropped.
FTP Connections
Number of FTP connections opened.
MAC Frames
Number of MAC frames received and transmitted on the CSM backplane connection.
For getting details on all of these commands kindy refer Catalyst 6500 Series Switch Content Switching Module Command Reference, 4.2 URL mentioned below:
http://cisco.biz/en/US/docs/interfaces_modules/services_modules/csm/4.2.x/command/reference/cmdrfIX.html
Kindly Rate.
HTH
Sachin Garg

Timeout value in the Manual Actions...

Hi Everyone,
I am actually facing a weird problem with respect to the timeout
value. My workflow has the following Manual Action in the Notify
Activity which does wait for 1 min max and should continue to proceed
forward.
===
<ManualAction id='0' name='Processing in backround' timeout='1' hidden='true'>
<Owner>
<ref>WF_CASE_OWNER</ref>
</Owner>
</ManualAction>
========
However, the workflow is getting into the suspended mode
Workflow task report:
Check completion 'Notify Activity' Waiting on work item owned by
'sample user' ---------------------------------------- Walking case
Walking case 'Sample Registration' Processing steps in 'Sample
Registration' Step pass 1 Check completion 'Notify Activity' Waiting
on work item owned by 'sample user' Case suspended with resume date
10/14/09 05:28:00 EDT Finished executing workflow case Sample
Registration
Task Instance Report:
<Step id='2' activityId='2' state='executing' title='Notify' Activity='3'>
<Result actionId='1' owner='#ID#Configurator'
workItem='#ID#5BF16F45GF17091:-3678932225576A432:-7CED'
timeout='2009-10-15T00:38:16.326Z'/>
</Step>
The workflow should wait for max 1 min and should proceed forward.
However, as you see in the above the timeout value set is
2009-10-15T00:38:16.326Z which seems odd because the workflow has
been suspended with resume date 10/14/09 05:28:00 EDT. But the timeout
value seems higher rather than just timing out for 1 min
Can anyone tell me who is setting the following below and where is
thing being picked up? I don't think its even honoring the 1 min
value?
timeout='2009-10-15T00:38:16.326Z'
Overall result is task waits for couple of hours and then gets
executed. Seems to me like a bug? Please let me know your thoughts on
this?
Thanks.

Hello javelkur, thanks for answer.
The TCL is the Cisco TCL IVR Script (its-CISCO.2.0.2.0.tcl).
If I call the ip phone directly is the same issue.
Thanks in advance.

Automatically Lock the Computer After a Specified Timeout Value

Is there any way to set a Win 7 box to automatically lock after a set timeout value with either GPO or the registry
without having to enable a screensaver? All my searching has come up with using the screensaver to accomplish this. We do not use a screensaver but instead turn the monitors off, screensavers are so 90's. Thanks.

Hi Brad5689,
There is a group policy we can have a try .
Computer Configuration | Administrative Templates | System | Power Management|Video and display
Conserving Energy with Group Policy(It is also applied to Windows 7)
https://technet.microsoft.com/en-us/magazine/cc462804.aspx
Best regards
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

How do I set the IFSshell timeout value?

How do I set the IFSshell timeout value?
I open an ifsshell and move to a directory.
Do something. Come back in 10 minites and the shell has timed
out. Have to logout and log back in and move to the directory
again.
Thanks
-Mitch

FYI,
IFS.PROTOCOLSERVER.SESSION.DEFAULT.Timeout
IFS.PROTOCOLSERVER.SessionStateTimeoutPeriod
IFS.PROTOCOLSERVER.SessionStateTimeoutPeriod
in cup server configuration

What does "PO:Approval Timeout Value" profile mean

Hi,
Is the value to be entered for "PO:Approval Timeout Value" profile option in terms of days/hours??

Metalink Doc ID: Note:276523.1
There is a new profile option called PO: Approval Timeout Value.
It is set by default to 300. What does it do and how does it work?
When the user performs Approval for either a purchase order or a requisition, the Approval Document Manager gets timeout if a document is under process after 180 seconds. There was no way to control the value for this timeout before 11.5.9.
In 11.5.9 a new profile seeded with default of 300 seconds was introduced to extend the approval timeout value. The PO_REQUEST_ACTION package was modified to get the value from the profile option.
NEW PROFILE DETAILS:
Profile Name : PO: Approval Timeout Value
Description : Approval Timeout to wait for the Doc Manager to return in sec.
Site Level value: 300 seconds. (SEEDED AS DEFAULT)
Max.Access Level: SITE only.
Thanks,
Saurabh

Changing policy domain timeout value

Hi Idm folks,
Can we configure a different timeout values on policy domains protecting different applications?
For example; policy domain /domain01/... has a 15 miunte idle session timeout and policy doomain02/... would have a 6 hour idle session timeout.
I don't think we can, wanted to check if anyone had ever came across this requirement?
thanks!

For different applications are you using different webgates? In that case you can think of using separate host identifiers for different webgates and create policies for host identifiers and you can have different timeout values for webgates.
BUT, in a SSO scenario what kind of complication it will bring, needs to be evaluated on the environment (mainly the central and application webgate domain for obSSOCookie) and requirements. This can be an interesting exercise, I guess. :)

V1.5 ORB Setting Timeout values

Is it possible to set the timeout values used by the Java ORB?
I can�t find any information about it�
I know that in version 1.4.x was impossible.
I tried this with different values, but no success�
// transport read tcp timeout property, colon separated property
// with syntax <initial time to wait:max read giop header time to
// wait: max read message time to wait:backoff factor>
properties.put( "com.sun.CORBA.transport.ORBTCPReadTimeouts", "0:0:0:0");
orb = ORB.init(args, properties);I know the values are passed to the ORB properties (debug in eclipse), but the sockets created for the connections don�t use them�
Can some one please tell me how?
Ps: I know that JacORB offer this feature but I prefer continuing using the ORB offered by sun.
Thanks in advance!

I have had the code to do it in Java 1.4 for a couple years now. It is below with instructions. Last year I started porting to Java 5 and have been unable to find the solution until now. That is below as well.
(I am typing this from a printed copy so bear with me)
Java 1.4
// to use set the system property -
// com.sun.CORBA.connection.ORBSocketFactoryClass = Jre4SocketFactory
import com.sun.corba.se.connection.EndPointInfo;
import com.sun.corba.se.connection.GetEndPointInfoAgainException;
import com.sun.corba.se.internal.iiop.DefaultSocketFactory;
import java.io.IOException;
import java.net.ServerSocket;
import java.net.Socket;
public class Jre4SocketFactory
   extends DefaultSocketFactory
   public ServerSocket createServerSocket(String type, int port)
      throws IOException
      ServerSocket result = super.createServerSocket(type, port);
      result.setSoTimeout(3000);
      return result;
   public Socket createSocket(EndPointInfo epi)
      throws IOException, GetEndPointInfoAgainException
      Socket result = super.createSocket(epi);
      result.setSoTimeout(3000);
      return result;
Java 5
// to use set the system properties -
// com.sun.CORBA.transport.ORBSocketFactoryClass = Jre5SocketFactory
// com.sun.CORBA.transport.ORBConnectionSocketType = Socket
import com.sun.corba.se.transport.DefaultSocketFactoryImpl;
import java.io.IOException;
import java.net.InetSocketAddress;
import java.net.ServerSocket;
import java.net.Socket;
public class Jre5SocketFactory
   extends DefaultSocketFactoryImpl
   public ServerSocket createServerSocket(String type, InetSocketAddress in)
      throws IOException
      ServerSocket result = super.createServerSocket(type, in);
      result.setSoTimeout(3000);
      return result;
   public Socket createSocket(String type, InetSocketAddress in)
      throws IOException
      Socket result = super.createSocket(type, in);
      result.setSoTimeout(3000);
      return result;
}This is just how I did timeouts in corba. You can also implement encryption etc by using this method and wrapping up the socket. I figured out both of them by reading the source code out in com.sun.corba.se...etc. Both of the above are tested and work great in operational code.
--Zerothbase

How to decrease timeout value when there is no response from BOE server?

We are using BOE XI R2 .NET SDK to logon BOE XI R2 Server as below as well as using Infoview/CMC logon BOE:
set boSessionManager = Server.CreateObject("CrystalEnterprise.SessionMgr")
set boEnterpriseSession = boSessionManager.Logon(boUserID, boPassword, boCMS, boAuthType)
There is no response for long time from BOE server after I excuting log on BOE using .NET SDK or Infoview/CMC App for more than one minute.
So I want to timeout the logon atction after a certain time such as one minute if there is no response from BOE server.
My question comes:
1. What is the default timeout value for this operation?
    Where can I find it and how to modify it?
2. I found ther are some registry keys on .NET APP Server:
    HKEY_LOCAL_MACHINE\SOFTWARE\Business Objects\Suite 12.0\Report Application Server\InprocServer\EnterpriseRequestTimeout
    HKEY_LOCAL_MACHINE\SOFTWARE\Business Objects\Suite 12.0\Report Application Server\Client SDK\CorbaAdapter\WaitReplyTimeout
Are they for the action timeout I mentioned above? If not, what do they work for?
It seems that WaitReplyTimeout is for report data retrieval timeout according to Kbase article 1199286 and which registry setting to change for long running reports, is it correct?
Thanks for any response.
Thanks,
Sunny

I don't think there is a setting available for this. The timeouts you are looking at are essentially how long to wait for a report to process.
My concern about trying to find a setting like this is that if you do get the client (aka SDK) to timeout after one minute, the CMS may still recieve this request shortly after and logon, creating a session that no longer has a handle to it and will then have to wait for it to timeout because of inactivity which would tie up a license.

Timeout value while providing Webservice

I am exposing a Web service in abap which has to be consumed in .net framework.
I need to know where in SOAMANAGER should i set maximum Timeout value which would determine how long the consumer should wait for response.
And where to set maximum message size in SOAMANAGER.
Edited by: anshulkaistha on Apr 6, 2011 7:18 AM

at the oc4j directory you can find in j2ee\home\config the file transaction-manager.xml where you can change the value of transaction-timeout
cumps
DnlCY

TACACS+ timeout value ignored

Similar Messages

Maybe you are looking for