Questions tagged [tacacs]
For questions about Terminal Access Controller Access-Control System (TACACS) and its variants (XTACACS, and TACACS+).
37 questions
0
votes
0
answers
98
views
DNAC command accounting
We are trying to integrate DNAC with ISE purely for Tacacs. We are able to authenticate and authorize users fine via Tacacs but we are not getting any tacacs command accounting sent to ISE.
Intention ...
- 1
1
vote
0
answers
108
views
TACACS Through ASA L2L Tunnel
Hello see below network diagram.
I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
- 171
4
votes
2
answers
430
views
TACACS+ AAA over L2L VPN
I have a practice network set up with the relevant topography shown in the below image:
I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
- 171
2
votes
1
answer
395
views
AAA Authorization on IOS
Still working away on a project (not for real life deployment so don't worry about seeing passwords).
I have a Tacacs server set up for centralised AAA. I am trying to set up two users, "admin&...
- 171
1
vote
1
answer
886
views
Access TACACS+ Server through ASA
I am trying to set up TACACS+ for a project. The below image shows the layout of the network.
So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
- 171
0
votes
1
answer
1k
views
Tacacs+ login asking ENABLE password & logs not working
I am new to TACACS so please bear me with my novice level questions :)
I have configured TACACS+ on Ubuntu. now I can login to switch with users defined in TACACS+ server. I have created two users, ...
- 147
1
vote
1
answer
124
views
ISE as RADIUS server or not in EAP-TLS authentication
Does the ISE server act as a RADIUS server to a Switch proxying a supplicant certificate, or does it use some other protocol? This is for EAP-TLS based auth
- 13
0
votes
1
answer
614
views
Prioritizing SSH, Telnet, TACACS in Cisco IOS
For Prioritizing SSH, Telnet, TACACS locally generated traffic on Cisco ASR running IOS XR, we have:
ssh server dscp 48
tacacs-server ipv4 dscp 48
Need the same for cisco GSR: 12416/PRP running IOS. ...
- 67
1
vote
1
answer
332
views
Tacacs+ over VPN is not working
R3 is a Tacacs+ client and Server0 is configured as AAA server with Tacacs+ but R3 is not able to authenticate.
R3 Configuration:
!
version 15.4
no service timestamps log datetime msec
no service ...
- 78
2
votes
1
answer
943
views
Cisco Mobility Express - supported authentication options
What are the supported authentication options for the ME APs? Do they support only login through local credentials or RADIUS/TACACS+ is also supported?
- 107
3
votes
1
answer
222
views
Config comments logging on Cisco devices via Tacacs+
I am implementing Tacacs+ in our network. It is a great tool with which help I can see where and when changes were introduced in our network. Though it's great I'd want to implement an extra feature - ...
- 45
5
votes
2
answers
3k
views
AAA authentication for all users and a single user for local only?
Is it possible to have AAA for a switch or router, dealing with JunOS, IOS and NXOS. Where all users default to a radius/tacacs server but there is a single user that bypasses the remote auth and uses ...
- 215
3
votes
1
answer
573
views
PLEASE HELP with TACACS with AD auth (error: Expected 'service', but got 'servive')
How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?
I ran all the tac_plus commands as per above but I cant seem to get answers for ...
1
vote
1
answer
96
views
Cisco: Return key needed after remote ssh console access using rotaries
I´m configuring a remote ssh access with TACACS to a console in a Cisco 2911, on a rotary port. When the access is granted after a successful ssh authentication, an Return key is needed to access the ...
6
votes
1
answer
19k
views
How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?
How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?
- 151
1
vote
1
answer
1k
views
Cisco TACACS authentication config
I'm inheriting a DoD network (completely separated from the Internet). I'm looking at the configs and I'm seeing a bunch of stuff I think isn't needed but I've never used TACACS, just Radius.
The ...
- 113
1
vote
2
answers
525
views
How does Tacacs server forward the credentials from client to Authentication server?
How does Tacacs server forward the credentials from client to Authentication server?
Does a decryption and Encryption of creds takes place? Or is it just a packet forward ?
Edit: The authentication ...
- 113
1
vote
1
answer
2k
views
TACACS: multiple source interfaces
I have a Cisco router connected to a TACACS server via two interfaces. As a prerrequisite, no loopback should be set on the router. My question is:
Is it possible to set these two interfaces as ...
3
votes
1
answer
3k
views
Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable
I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured ...
- 1,071
2
votes
2
answers
189
views
Limit Access to a Specific VRF?
I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch.
Note, I am not ...
- 210
0
votes
1
answer
799
views
CISCO Switch SSH Certificate via TACACS-Server
I'm currently a trainee, and I am assigned to do a task where I have to find out whether it is possible if a switch can get its certificate by contacting the TACACS-Server.
To explain what I'm trying ...
- 1
3
votes
2
answers
3k
views
TACACS Implentation server key error
I'm implementing a new TACACS server on our network after having removed the old TACACS server which we no longer own. I've already gotten the implementation working with the NX-OS devices, but when ...
- 65
1
vote
0
answers
2k
views
TACACS with Juniper Devices
Can any one please help in configuring a TACACS+ server, along with configuration in Juniper devices?
Ubuntu Server 14.04
Juniper QFX5100 switch
Below are my configurations:
For the TACACS+ server:
...
- 121
1
vote
3
answers
2k
views
After configuring tacacs cannot access to cli
After configuring Tacacs+ cannot access throught tacacs or telnet:
aaa new-model
!
!
aaa group server tacacs+ TACACS+CG
server [server ip address]
server [server ip address]
!
aaa authentication ...
- 327
2
votes
1
answer
599
views
tacacs server hostname problem
When I am trying to configure tacacs hostname I have this message . I can't find solution for this problem.
Router(config)#tacacs-server host 192.168.20.1
Warning: The cli will be deprecated soon '...
- 21
1
vote
2
answers
76
views
enable additional commands centrally for IOS privilege levels other than 15
Privilege level 15 in IOS has all the possible commands for particular IOS release enabled. However, for example privilege level 1 has only few dozens of commands available. Now if I want to allow ...
- 1,121
4
votes
2
answers
3k
views
Can you only allow local login when TACACS is unavailable on a Juniper?
I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device. Is there a way to restrict local accounts from being accessed if the router has access to ...
- 401
1
vote
0
answers
620
views
can TACACS in VRF source interface be the ip for a Port-channel? [closed]
We have two VSS switch pairs, one which has TACACS working correctly with a similar config to this:
aaa group server tacacs+ TacacsVrf
server-private 10.4.25.8 key 7 ourKeyIsSecret
ip ...
- 11
2
votes
2
answers
2k
views
Privileged EXEC mode not accessible after the upgrade
I hope you are well.
I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - "...
- 72
10
votes
1
answer
8k
views
Authenticate ssh key via Cisco ACS (TACACS+)
I can set a router to authenticate via a ssh public-key with:
ip ssh pubkey-chain
username admin
key-string
<ssh-pub-key>
exit
exit
Is it possible to do something similar with Cisco ...
- 362
5
votes
1
answer
7k
views
Cisco 2960 switch will not recognize new TACACS+ commands
I'm trying to add tacacs info to a switch. However, I'm unable to use the new tacacs commands, even though the switch tells me to.
WS-C2960-24PC-L - Version 15.0(2)SE5
switch(config)#tacacs-server ...
- 754
7
votes
1
answer
9k
views
AAA Authorization Timeout
Log into a Cisco IOS device with TACACS Authorization enabled
Do a command that causes the device to lose access to the TACACS server
Enter a command that requires TACACS Authorization
By default, ...
- 1,589
1
vote
1
answer
119
views
SecureACS - and LDAP
I'm having problems understanding the concept of how ACS is supposed to work. Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box. However, anyone w/ a ...
- 11
2
votes
0
answers
2k
views
AAA - IP HTTP server: local authentication and authorization
We configure AAA on router for the Telnet/SSH access. We activate HTTP on our router to our provisioning tool. The provisioning tool needs to retrieve information and execute some command on the HTTP ...
- 2,008
5
votes
2
answers
2k
views
Does the Cisco SF 302-08P Small Business Switch support accounting commands to tacacs?
We have a handful of small business switches from cisco, model SF 302-08P. I'm trying to configure them for full tacacs support, however it appears that the model only supports tacacs for ...
- 705
10
votes
1
answer
4k
views
Long login delay when cisco device is booted
Whenever we boot or reboot a Cisco router or switch we have to wait a number of minutes before we can get a username prompt for login. We get a few fail messages
Press RETURN to get started.
% ...
- 3,129
7
votes
2
answers
3k
views
Tacacs VRF authentication
We just got a new Supervisor7 with os 3.4.1. I'm trying to configure authentication with tacacs, and I can't understand how to make it work. This configuration works on our other switches, but it ...
- 267