9
votes
Accepted
How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?
UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev)
UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269,...
- 151
5
votes
Accepted
AAA authentication for all users and a single user for local only?
Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely.
username localadmin password ...
- 68.1k
5
votes
PLEASE HELP with TACACS with AD auth (error: Expected 'service', but got 'servive')
You misspelled the word service:
default servive = permit
- 32.6k
4
votes
Accepted
TACACS+ AAA over L2L VPN
In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA ...
- 4,690
4
votes
TACACS+ AAA over L2L VPN
Your configuration
aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10
key testing123
defines the inside interface as the source.
- 68.1k
4
votes
Accepted
AAA Authorization on IOS
Edited:
You use the group tacacs+ for your authentication, but you have not configured a server group for that. Here is a corrected configuration:
aaa authentication login default group HQTACACS ...
- 68.1k
3
votes
Accepted
Access TACACS+ Server through ASA
On your router, all of your static routes pointing to your firewall are wrong. You need to define the next hop since you aren’t on a PTP link.
Please remove all of the routes pointing to Eth0/1 using ...
- 4,690
3
votes
Accepted
Tacacs+ over VPN is not working
You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your ...
- 4,690
3
votes
Accepted
Config comments logging on Cisco devices via Tacacs+
Two methods for this: one is a trick for where to put comments, the second is the syslog+git approach to looking after the configurations which one of my clients uses.
Method 1: ACL with comments
I ...
- 16.4k
2
votes
AAA authentication for all users and a single user for local only?
This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens):
aaa authentication login default local ...
- 1,135
2
votes
Cisco: Return key needed after remote ssh console access using rotaries
There is a command for this: autoselect
It´s explained in Cisco docs:
Cisco Help
The autoselect command bypasses the login prompt and enables the specified session to begin automatically. However, ...
2
votes
Accepted
Cisco TACACS authentication config
The config you've posted is pretty common, and I suppose it was developed to be as flexible as possible, with separate methods for VTY and console access, as well as separate command authorization for ...
- 68.1k
2
votes
Accepted
How does Tacacs server forward the credentials from client to Authentication server?
RADIUS was designed to authenticate and log dial-up remote users to a
network, and TACACS+ is used most commonly for administrator access to
network devices like routers and switches.
http://www....
- 4,409
1
vote
Cisco Mobility Express - supported authentication options
If you mean host to network attachment, then it works much like any other Cisco wireless products using WPA2 Personal (Pre-Shared Key) or WPA2 Enterprise (802.1X using RADIUS).
If you mean logging ...
- 101k
1
vote
Accepted
Tacacs+ login asking ENABLE password & logs not working
I want to allow only fixed sets of CMD's for SUPPORT group.
This issue is two-fold:
You need to configure your device to use TACACS for authorization:
(config)#aaa authorization commands 15 ...
(...
- 9,057
1
vote
Accepted
ISE as RADIUS server or not in EAP-TLS authentication
Does the ISE server act as a RADIUS server to a Switch proxying a supplicant certificate, or does it use some other protocol? This is for EAP-TLS based auth
Whenever you have an EAP based ...
- 27.4k
1
vote
TACACS: multiple source interfaces
Not using a loopback address can cause many problems, as you will likely discover on your own ;-p
The command you quote is used to specify the source interface, if I understand your question. You ...
- 68.1k
1
vote
Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable
On the ASA platform, each "A" in AAA is processed independently. Furthermore, each entry method for authentication is processed independently. So, you have TACACS setup for SSH and ASDM, ...
- 1,033
Only top scored, non community-wiki answers of a minimum length are eligible