system logs display "TACACS auth server x.x.x.x is up !!!" without any down messages.
2149
Created On 07/20/23 01:38 AM - Last Modified 11/03/23 21:44 PM
Symptom
- system log (show log system) of a firewall or panorama display entries similar to "TACACS+ auth server x.x.x.x is up !!!"
- The system log does not show any entries where the TACACS server is down.
Environment
- Palo Alto Firewall or Panorama
- PAN-OS 10.0, 10.1, 10.2, 11.0
- TACACS or other server profile such as Kerberos and LDAP.
Cause
- The auth server messages being "down" followed by "up" messages occur during normal scenario.
- In this case, the software defect causes the "up" message to appear erroneously whenever the socket is reconnected, even if no communications error has occurred.
- It is normal behavior for the TCP connection with the TACACS or other server to sometimes go idle. The reconnection is triggering the "up" message without any "down" message.
Resolution
- This is cosmetic issue addressed under PAN-222418 in PAN-OS 10.1.12, 10.2.8, 11.0.3 and 11.1.0,
- One can safely ignore the message till upgrade since this is cosmetic issue.