> Source: [sk170092](https://support.checkpoint.com/results/sk/sk170092)

# sk170092 - TACACS+ fails to authenticate

| Property | Value |
|----------|-------|
| Solution ID | sk170092 |
| Date Created | 2020-10-18 |
| Last Modified | 2020-10-18 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * TACACS+ fails to authenticate.
* The following is found in `/var/log/messages`:  

  ```
  tac_authen_read: error reading authen header, read 0 of 12: Operation now in progress
  PAM_tacplus : auth failed: 2
  ```

* Traffic capture shows two way communication with the Cisco ACS, but the logs on the ACS do not show the authentication attempt.

## Cause

The authentication request is being sent to the CISCO ACS from a source IP that has not been configured on the client list.   

Note: The firewall does not send the request using the main IP of the firewall object from smart console. The source IP will depend on the IP of the interface the traffic will leave through to reach the CISCO ACS.

## Solution

Follow this procedure:

1. Verify which Source IP the traffic is leaving with using any method you choose, a traffic capture would be a good option. When using a cluster the traffic will use the VIP of the interface as its source if the hide fold setting has not been altered.
2. Connect to the CISCO ACS and add the IP address into the client list ( the client list is where you also configure the shared secret used for TACACS+).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content