Information
Force AAA to use the IP address of a specified interface for all outgoing AAA packets
Rationale:
This is required so that the AAA server (RADIUS or TACACS+) can easily identify routers and authenticate requests by their IP address.
Solution
Bind AAA services to the loopback interface.
Hostname(config)#ip radius source-interface loopback {loopback_interface_number}
or
Hostname(config)#aaa group server tacacs+ {group_name} hostname(config-sg-tacacs+)#ip tacacs source-interface {loopback_interface_number}
Impact:
Organizations should design and implement authentication, authorization, and accounting (AAA) services for effective monitoring of enterprise network devices. Binding AAA services to the source-interface loopback enables these services.
References:
http://www.cisco.com/en/US/docs/ios-xml/ios/security/d1/sec-cr-i2.html#GUID-22E8B211-751F-48E0-9C76-58F0FE0AABA8
http://www.cisco.com/en/US/docs/ios-xml/ios/security/d1/sec-cr-i3.html#GUID-54A00318-CF69-46FC-9ADC-313BFC436713