13
If your switch supports it (not all IOS versions do), the following command should fix this for you:
no aaa accounting system guarantee-first
Here is an article that goes into more depth: Would you mind waiting for 2-3 mins in a console?
And a bit from Cisco's documentation:
Establishing a Session with a Router if the AAA Server is Unreachable
...
11
sw-R2-3#show ver | i Software
Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.0(2)SE3, RELEASE SOFTWARE (fc1)
sw-R2-3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
sw-R2-3(config)#tacacs?
tacacs tacacs-server
sw-R2-3(config)#tacacs ?
server Server configuration
sw-R2-3(config)#tacacs server ?
WORD Name ...
9
UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev)
UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269, completely remove the USE_TLS configuration variable from your tac_plus.cfg. This will fix the problem. I've emailed the author with my findings.
This guide ...
9
It looks like, "No". There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload could suffice. (the RFC is a decade old) The real question is if ACS has any method to handle it? And that also appears to be "no". The only mention I can find to PKI or certificate based authentication is for EAP-TLS, which is not ...
8
This configuration works on our other switches, but it doesn't work on this 4500.
You're using the on-board Sup7 FastEthernet port, so this is your problem:
aaa authentication login default group tacacs+ local
^^^^^^^^^^^^^
The Sup7 OOB port is in a VRF; therefore, you have to configure Tacacs+ in a VRF
aaa new-model
!
no ...
6
This is actually default behavior.
The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS).
So in your case, the only time your local password database will be consulted is if the TACACS server(s) fail to respond to any requests. If you attempt to login, but TACACS rejects your password, the ...
5
Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely.
username localadmin password xyz priv 15
aaa authentication login CONSOLE local
aaa authentication login VTY group tacacs+ local
aaa authorization exec VTY if-authenticated
aaa ...
5
You misspelled the word service:
default servive = permit
3
You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your outside interface, and fail. Please add the command ip tacacs source-interface GigabitEthernet0/0/1 on R3 and report back if it is resolved.
3
Two methods for this: one is a trick for where to put comments, the second is the syslog+git approach to looking after the configurations which one of my clients uses.
Method 1: ACL with comments
I believe there is no way to put comments directly in the Cisco configuration, so I confess I abuse an ACL:
ip access-list extended CHANGELOG
remark 2018-01-01: ...
3
It's a warning that you are using an old, soon to be removed, configuration syntax, and gives you the new command. There are plenty of guides on the subject; Ron pointed out one of them.
3
Yes, this is the exact purpose of the second "a" in "aaa". Authorization is the process of limiting which commands a user is able to execute based on their user/group profile.
There are many different products that provide aaa services in a centralized manner, some paid and some free.
3
Answering, so community will quit bumping this active...
We have a handful of small business switches from cisco, model SF 302-08P. I'm trying to configure them for full tacacs support, however it appears that the model only supports tacacs for authentication, not for accounting.
As of firmware version 1.3.7.18, you can configure tacacs accounting for ...
2
The most common way is to segregate access based on group membership. Within ACS there is/should be an "Access Policies" menu - I won't go into every detail of configuring ACS here, because that's why there's a manual, but you can essentially define your policies of which groups members can log in (and which group members have access to run which commands) ...
2
To answer your question: Yes. ;)
Problem solution is actually easy, as it turns out - I will be quoting what I found out:
The NX-OS password scheme is a normal rotation cipher. This is the sequence:
3 22 4 5 18 0 21 5 18 3 10 5 16 22 4 16 24 17 12 5 21 18 5 22 19 7
This means for 'cisco123'
c + 3 = f
i + 22 - 26 (i+22 is > 26) = i - 4 = e
s + 4 = w
c ...
2
The config you've posted is pretty common, and I suppose it was developed to be as flexible as possible, with separate methods for VTY and console access, as well as separate command authorization for regular and privileged users.
So yes, you can simplify it. You can remove the CON and VTY methods, and just use the default method (since they're all the ...
2
RADIUS was designed to authenticate and log dial-up remote users to a
network, and TACACS+ is used most commonly for administrator access to
network devices like routers and switches.
http://www.tacacs.net/docs/TACACS_Advantages.pdf
2
There is a command for this: autoselect
It´s explained in Cisco docs:
Cisco Help
The autoselect command bypasses the login prompt and enables the specified session to begin automatically. However, when the autoselect command is entered with the during login keyword, the username or password prompt appears without the need to press the Return key; thus “...
2
Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's all they need.
2
This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens):
aaa authentication login default local group radius
That tries the local database first, then tries the RADIUS authentication group. You can use TACACS+ instead of RADIUS.
If the username submitted ...
1
I want to allow only fixed sets of CMD's for SUPPORT group.
This issue is two-fold:
You need to configure your device to use TACACS for authorization:
(config)#aaa authorization commands 15 ...
(config)#aaa authorization config-commands
(config)#aaa authorization exec default ...
Your tac_plus config looks weird. Changing it so that it's in more of a ...
1
Does the ISE server act as a RADIUS server to a Switch proxying a supplicant certificate, or does it use some other protocol? This is for EAP-TLS based auth
Whenever you have an EAP based authentication, a RADIUS server of some sort is involved. This could be ISE (Cisco's current RADIUS server product) or some other RADIUS server solution.
Like many vendor ...
1
If you mean host to network attachment, then it works much like any other Cisco wireless products using WPA2 Personal (Pre-Shared Key) or WPA2 Enterprise (802.1X using RADIUS).
If you mean logging into the controller, it is very much like any other Cisco device, and you can use AAA with RADIUS or TACACS+.
Cisco maintains a full library of documentation for ...
1
The short answer is no, because the SSH authentication happens before the login authentication (where the TACACS server is contacted).
Even if it were possible to download the certificate, you would then have the problem of verifying that the device that downloaded it is in fact the right switch.
I suspect having the certificate on the switch is ...
1
Not using a loopback address can cause many problems, as you will likely discover on your own ;-p
The command you quote is used to specify the source interface, if I understand your question. You can only specify one.
If you don't specify the source interface, the router will use the interface closest to the destination, based on the routing table. If you ...
1
Just to close this out, I worked with Cisco support to configure ACS to limit their access as much as possible but they did confirm that you cannot limit access to a VRF.
I also asked them if I could allow access to all commands in a particular mode using Cisco ACS (i.e. everything under config-if) and the answer was no to that one too. The guy said you ...
1
The instant you enter aaa authorization commands, TACACS applies to every command you enter. If you aren't authenticated by TACACS, you will be unable to do anything. If the tacacs server(s) aren't reachable, there can be significant delays for each command as it tries to authorize them.
1
Definitely yes.
I personally prefer this tacacs+ implementation http://www.pro-bono-publico.de/projects/tac_plus.html
And use setup similar to http://blog.one-it.de/open-source-multidevice-multiuser-tacacs/
Relevant portion of the config is USERGROUPS.
1
This is a part of the config I am using on 4506 running 12.2
username failsafe secret [local password]
aaa new-model
!
!
aaa authentication attempts login 3
aaa authentication fail-message ^Your fail message here.^
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group ...
Only top voted, non community-wiki answers of a minimum length are eligible
