Hot answers tagged

9 votes
Accepted

Authenticate ssh key via Cisco ACS (TACACS+)

It looks like, "No". There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload could suffice. (the RFC is a decade old) The real question is if ACS has ...
user avatar
  • 29.7k
9 votes
Accepted

How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?

UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev) UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269,...
user avatar
  • 151
6 votes
Accepted

Can you only allow local login when TACACS is unavailable on a Juniper?

This is actually default behavior. The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS). So in your case, the only time your local ...
user avatar
  • 6,450
5 votes
Accepted

AAA authentication for all users and a single user for local only?

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password ...
user avatar
  • 63k
5 votes

PLEASE HELP with TACACS with AD auth (error: Expected 'service', but got 'servive')

You misspelled the word service: default servive = permit
user avatar
  • 29.7k
4 votes
Accepted

TACACS+ AAA over L2L VPN

In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA ...
user avatar
  • 4,661
4 votes

TACACS+ AAA over L2L VPN

Your configuration aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10 key testing123 defines the inside interface as the source.
user avatar
  • 63k
4 votes
Accepted

AAA Authorization on IOS

Edited: You use the group tacacs+ for your authentication, but you have not configured a server group for that. Here is a corrected configuration: aaa authentication login default group HQTACACS ...
user avatar
  • 63k
3 votes
Accepted

Access TACACS+ Server through ASA

On your router, all of your static routes pointing to your firewall are wrong. You need to define the next hop since you aren’t on a PTP link. Please remove all of the routes pointing to Eth0/1 using ...
user avatar
  • 4,661
3 votes
Accepted

Tacacs+ over VPN is not working

You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your ...
user avatar
  • 4,661
3 votes
Accepted

Config comments logging on Cisco devices via Tacacs+

Two methods for this: one is a trick for where to put comments, the second is the syslog+git approach to looking after the configurations which one of my clients uses. Method 1: ACL with comments I ...
user avatar
  • 15.9k
3 votes

tacacs server hostname problem

It's a warning that you are using an old, soon to be removed, configuration syntax, and gives you the new command. There are plenty of guides on the subject; Ron pointed out one of them.
user avatar
  • 29.7k
3 votes

enable additional commands centrally for IOS privilege levels other than 15

Yes, this is the exact purpose of the second "a" in "aaa". Authorization is the process of limiting which commands a user is able to execute based on their user/group profile. There are many ...
user avatar
  • 26.8k
2 votes
Accepted

TACACS Implentation server key error

To answer your question: Yes. ;) Problem solution is actually easy, as it turns out - I will be quoting what I found out: The NX-OS password scheme is a normal rotation cipher. This is the sequence: ...
user avatar
  • 440
2 votes

Limit Access to a Specific VRF?

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's ...
user avatar
  • 63k
2 votes

AAA authentication for all users and a single user for local only?

This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens): aaa authentication login default local ...
user avatar
  • 1,125
2 votes

Cisco: Return key needed after remote ssh console access using rotaries

There is a command for this: autoselect It´s explained in Cisco docs: Cisco Help The autoselect command bypasses the login prompt and enables the specified session to begin automatically. However, ...
user avatar
2 votes
Accepted

Cisco TACACS authentication config

The config you've posted is pretty common, and I suppose it was developed to be as flexible as possible, with separate methods for VTY and console access, as well as separate command authorization for ...
user avatar
  • 63k
2 votes
Accepted

How does Tacacs server forward the credentials from client to Authentication server?

RADIUS was designed to authenticate and log dial-up remote users to a network, and TACACS+ is used most commonly for administrator access to network devices like routers and switches. http://www....
user avatar
1 vote

Cisco Mobility Express - supported authentication options

If you mean host to network attachment, then it works much like any other Cisco wireless products using WPA2 Personal (Pre-Shared Key) or WPA2 Enterprise (802.1X using RADIUS). If you mean logging ...
user avatar
  • 94.1k
1 vote
Accepted

Tacacs+ login asking ENABLE password & logs not working

I want to allow only fixed sets of CMD's for SUPPORT group. This issue is two-fold: You need to configure your device to use TACACS for authorization: (config)#aaa authorization commands 15 ... (...
user avatar
  • 8,887
1 vote
Accepted

ISE as RADIUS server or not in EAP-TLS authentication

Does the ISE server act as a RADIUS server to a Switch proxying a supplicant certificate, or does it use some other protocol? This is for EAP-TLS based auth Whenever you have an EAP based ...
user avatar
  • 26.8k
1 vote

TACACS: multiple source interfaces

Not using a loopback address can cause many problems, as you will likely discover on your own ;-p The command you quote is used to specify the source interface, if I understand your question. You ...
user avatar
  • 63k
1 vote

Limit Access to a Specific VRF?

Just to close this out, I worked with Cisco support to configure ACS to limit their access as much as possible but they did confirm that you cannot limit access to a VRF. I also asked them if I could ...
user avatar
  • 210
1 vote

CISCO Switch SSH Certificate via TACACS-Server

The short answer is no, because the SSH authentication happens before the login authentication (where the TACACS server is contacted). Even if it were possible to download the certificate, you would ...
user avatar
  • 63k
1 vote

After configuring tacacs cannot access to cli

The instant you enter aaa authorization commands, TACACS applies to every command you enter. If you aren't authenticated by TACACS, you will be unable to do anything. If the tacacs server(s) aren't ...
user avatar
  • 29.7k

Only top scored, non community-wiki answers of a minimum length are eligible