Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tacacs]

For questions about Terminal Access Controller Access-Control System (TACACS) and its variants (XTACACS, and TACACS+).

2
votes
1answer
129 views

Cisco Mobility Express - supported authentication options

What are the supported authentication options for the ME APs? Do they support only login through local credentials or RADIUS/TACACS+ is also supported?
3
votes
1answer
80 views

Config comments logging on Cisco devices via Tacacs+

I am implementing Tacacs+ in our network. It is a great tool with which help I can see where and when changes were introduced in our network. Though it's great I'd want to implement an extra feature - ...
5
votes
2answers
885 views

AAA authentication for all users and a single user for local only?

Is it possible to have AAA for a switch or router, dealing with JunOS, IOS and NXOS. Where all users default to a radius/tacacs server but there is a single user that bypasses the remote auth and uses ...
3
votes
1answer
135 views

PLEASE HELP with TACACS with AD auth (error: Expected 'service', but got 'servive')

How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory? I ran all the tac_plus commands as per above but I cant seem to get answers for ...
1
vote
1answer
61 views

Cisco: Return key needed after remote ssh console access using rotaries

I´m configuring a remote ssh access with TACACS to a console in a Cisco 2911, on a rotary port. When the access is granted after a successful ssh authentication, an Return key is needed to access the ...
7
votes
1answer
7k views

How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?

How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?
1
vote
1answer
652 views

Cisco TACACS authentication config

I'm inheriting a DoD network (completely separated from the Internet). I'm looking at the configs and I'm seeing a bunch of stuff I think isn't needed but I've never used TACACS, just Radius. The ...
1
vote
1answer
212 views

How does Tacacs server forward the credentials from client to Authentication server?

How does Tacacs server forward the credentials from client to Authentication server? Does a decryption and Encryption of creds takes place? Or is it just a packet forward ? Edit: The authentication ...
1
vote
1answer
663 views

TACACS: multiple source interfaces

I have a Cisco router connected to a TACACS server via two interfaces. As a prerrequisite, no loopback should be set on the router. My question is: Is it possible to set these two interfaces as ...
1
vote
0answers
2k views

Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable

I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured ...
2
votes
2answers
81 views

Limit Access to a Specific VRF?

I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch. Note, I am not ...
0
votes
1answer
307 views

CISCO Switch SSH Certificate via TACACS-Server

I'm currently a trainee, and I am assigned to do a task where I have to find out whether it is possible if a switch can get its certificate by contacting the TACACS-Server. To explain what I'm trying ...
3
votes
2answers
1k views

TACACS Implentation server key error

I'm implementing a new TACACS server on our network after having removed the old TACACS server which we no longer own. I've already gotten the implementation working with the NX-OS devices, but when ...
1
vote
0answers
1k views

TACACS with Juniper Devices

Can any one please help in configuring a TACACS+ server, along with configuration in Juniper devices? Ubuntu Server 14.04 Juniper QFX5100 switch Below are my configurations: For the TACACS+ server: ...
1
vote
3answers
1k views

After configuring tacacs cannot access to cli

After configuring Tacacs+ cannot access throught tacacs or telnet: aaa new-model ! ! aaa group server tacacs+ TACACS+CG server [server ip address] server [server ip address] ! aaa authentication ...
1
vote
1answer
205 views

tacacs server hostname problem

When I am trying to configure tacacs hostname I have this message . I can't find solution for this problem. Router(config)#tacacs-server host 192.168.20.1 Warning: The cli will be deprecated soon '...
0
votes
2answers
53 views

enable additional commands centrally for IOS privilege levels other than 15

Privilege level 15 in IOS has all the possible commands for particular IOS release enabled. However, for example privilege level 1 has only few dozens of commands available. Now if I want to allow ...
3
votes
1answer
2k views

Can you only allow local login when TACACS is unavailable on a Juniper?

I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device. Is there a way to restrict local accounts from being accessed if the router has access to ...
1
vote
0answers
162 views

can TACACS in VRF source interface be the ip for a Port-channel?

We have two VSS switch pairs, one which has TACACS working correctly with a similar config to this: aaa group server tacacs+ TacacsVrf server-private 10.4.25.8 key 7 ourKeyIsSecret ip ...
2
votes
2answers
773 views

Privileged EXEC mode not accessible after the upgrade

I hope you are well. I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - "...
9
votes
1answer
6k views

Authenticate ssh key via Cisco ACS (TACACS+)

I can set a router to authenticate via a ssh public-key with: ip ssh pubkey-chain username admin key-string <ssh-pub-key> exit exit Is it possible to do something similar with Cisco ...
5
votes
1answer
6k views

Cisco 2960 switch will not recognize new TACACS+ commands

I'm trying to add tacacs info to a switch. However, I'm unable to use the new tacacs commands, even though the switch tells me to. WS-C2960-24PC-L - Version 15.0(2)SE5 switch(config)#tacacs-server ...
5
votes
1answer
4k views

AAA Authorization Timeout

Log into a Cisco IOS device with TACACS Authorization enabled Do a command that causes the device to lose access to the TACACS server Enter a command that requires TACACS Authorization By default, ...
1
vote
1answer
112 views

SecureACS - and LDAP

I'm having problems understanding the concept of how ACS is supposed to work. Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box. However, anyone w/ a ...
2
votes
0answers
1k views

AAA - IP HTTP server: local authentication and authorization

We configure AAA on router for the Telnet/SSH access. We activate HTTP on our router to our provisioning tool. The provisioning tool needs to retrieve information and execute some command on the HTTP ...
5
votes
2answers
1k views

Does the Cisco SF 302-08P Small Business Switch support accounting commands to tacacs?

We have a handful of small business switches from cisco, model SF 302-08P. I'm trying to configure them for full tacacs support, however it appears that the model only supports tacacs for ...
10
votes
1answer
3k views

Long login delay when cisco device is booted

Whenever we boot or reboot a Cisco router or switch we have to wait a number of minutes before we can get a username prompt for login. We get a few fail messages Press RETURN to get started. % ...
6
votes
2answers
3k views

Tacacs VRF authentication

We just got a new Supervisor7 with os 3.4.1. I'm trying to configure authentication with tacacs, and I can't understand how to make it work. This configuration works on our other switches, but it ...