Details
Force AAA to use the IP address of a specified interface for all outgoing AAA packets
Rationale:
This is required so that the AAA server (RADIUS or TACACS+) can easily identify routers and authenticate requests by their IP address.
Impact:
Organizations should design and implement authentication, authorization, and accounting (AAA) services for effective monitoring of enterprise network devices. Binding AAA services to the source-interface loopback enables these services.
Solution
Bind AAA services to the loopback interface.
Hostname(config)#ip radius source-interface loopback {loopback_interface_number}
or
Hostname(config)#aaa group server tacacs+ {group_name} hostname(config-sg-tacacs+)#ip tacacs source-interface {loopback_interface_number}
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Cisco.