0

In APIC, the implementation of AAA can be seen in the following path:

APIC > ADMIN > AAA > RADIUS Management > RADIUS Providers
APIC > ADMIN > AAA > TACACS+ Management > TACACS+ Providers

enter image description here

*Image from https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/basic-config/b_ACI_Config_Guide/b_ACI_Config_Guide_chapter_011.html

What is the equivalent command for this? I need to get this info including Host Name, Description, Port number and Timeout (sec) setting via SSH.

APIC# show aaa ?
 authentication  Show AAA Authentication information
 groups          Show AAA group information
APIC# 

APIC# show aaa authentication ?
 <CR>
APIC# show aaa authentication
Default : radius
Console : radius

APIC# show aaa groups ?
 <CR>
APIC# 

APIC# show aaa groups
Total number of Groups: 2

RadiusGroups : XYZ-RADIUS
TacacsGroups : XYZ-TACACS
LdapGroups   :
2

In CLI you can run these commands:

APIC# show run aaa group server tacacsplus TACACS
# Command: show running-config aaa group server tacacsplus TACACS
# Time: Wed Apr  1 15:27:27 2020
  aaa group server tacacsplus TACACS
    server SERVER-2 priority 10
    server SERVER-1 priority 5
    exit

APIC# show run tacacs-server host "SERVER-2"
# Command: show running-config tacacs-server host SERVER-2
# Time: Wed Apr  1 15:28:05 2020
  tacacs-server host "SERVER-2"
    exit

You may notice that additional parameters such as port or timeout are not displayed. This is because they're set to defaults.

And as always you can get this information from MO. On the APIC run bash and then execute curl command:

icurl -g -X GET 'http://localhost:7777/api/node/class/aaaTacacsPlusProvider.json' | jq '.'

For RADIUS:

icurl -g -X GET 'http://localhost:7777/api/node/class/aaaRadiusProvider.json' | jq '.'

Output for TACACS:

{
  "totalCount": "2",
  "imdata": [
    {
      "aaaTacacsPlusProvider": {
        "attributes": {
          "annotation": "",
          "authProtocol": "pap",
          "childAction": "",
          "descr": "",
          "dn": "uni/userext/tacacsext/tacacsplusprovider-SERVER-2",
          "epgDn": "",
          "extMngdBy": "",
          "lcOwn": "local",
          "modTs": "2019-02-11T10:23:19.748+03:00",
          "monPolDn": "uni/fabric/monfab-default",
          "monitorServer": "disabled",
          "monitoringUser": "default",
          "name": "SERVER-2",
          "nameAlias": "",
          "operState": "unknown",
          "ownerKey": "",
          "ownerTag": "",
          "port": "49",
          "retries": "1",
          "snmpIndex": "2",
          "status": "",
          "timeout": "5",
          "uid": "15374",
          "vrfName": ""
        }
      }
    },
    {
      "aaaTacacsPlusProvider": {
        "attributes": {
          "annotation": "",
          "authProtocol": "pap",
          "childAction": "",
          "descr": "",
          "dn": "uni/userext/tacacsext/tacacsplusprovider-SERVER-1",
          "epgDn": "",
          "extMngdBy": "",
          "lcOwn": "local",
          "modTs": "2019-02-11T10:23:14.350+03:00",
          "monPolDn": "uni/fabric/monfab-default",
          "monitorServer": "disabled",
          "monitoringUser": "default",
          "name": "SERVER-1",
          "nameAlias": "",
          "operState": "unknown",
          "ownerKey": "",
          "ownerTag": "",
          "port": "49",
          "retries": "1",
          "snmpIndex": "1",
          "status": "",
          "timeout": "5",
          "uid": "15374",
          "vrfName": ""
        }
      }
    }
  ]
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.