9 votes
Accepted

How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?

UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev) UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269,...
dt1235's user avatar
  • 151
5 votes
Accepted

AAA authentication for all users and a single user for local only?

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password ...
Ron Trunk's user avatar
  • 67.5k
5 votes

PLEASE HELP with TACACS with AD auth (error: Expected 'service', but got 'servive')

You misspelled the word service: default servive = permit
Ricky's user avatar
  • 32.2k
4 votes
Accepted

TACACS+ AAA over L2L VPN

In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA ...
Jesse P.'s user avatar
  • 4,690
4 votes

TACACS+ AAA over L2L VPN

Your configuration aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10 key testing123 defines the inside interface as the source.
Ron Trunk's user avatar
  • 67.5k
4 votes
Accepted

AAA Authorization on IOS

Edited: You use the group tacacs+ for your authentication, but you have not configured a server group for that. Here is a corrected configuration: aaa authentication login default group HQTACACS ...
Ron Trunk's user avatar
  • 67.5k
3 votes
Accepted

Tacacs+ over VPN is not working

You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your ...
Jesse P.'s user avatar
  • 4,690
3 votes
Accepted

Access TACACS+ Server through ASA

On your router, all of your static routes pointing to your firewall are wrong. You need to define the next hop since you aren’t on a PTP link. Please remove all of the routes pointing to Eth0/1 using ...
Jesse P.'s user avatar
  • 4,690
3 votes
Accepted

Config comments logging on Cisco devices via Tacacs+

Two methods for this: one is a trick for where to put comments, the second is the syslog+git approach to looking after the configurations which one of my clients uses. Method 1: ACL with comments I ...
jonathanjo's user avatar
  • 16.2k
2 votes
Accepted

TACACS Implentation server key error

To answer your question: Yes. ;) Problem solution is actually easy, as it turns out - I will be quoting what I found out: The NX-OS password scheme is a normal rotation cipher. This is the sequence: ...
xpac's user avatar
  • 440
2 votes

Limit Access to a Specific VRF?

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's ...
Ron Trunk's user avatar
  • 67.5k
2 votes
Accepted

Cisco TACACS authentication config

The config you've posted is pretty common, and I suppose it was developed to be as flexible as possible, with separate methods for VTY and console access, as well as separate command authorization for ...
Ron Trunk's user avatar
  • 67.5k
2 votes
Accepted

How does Tacacs server forward the credentials from client to Authentication server?

RADIUS was designed to authenticate and log dial-up remote users to a network, and TACACS+ is used most commonly for administrator access to network devices like routers and switches. http://www....
Ronnie Royston's user avatar
2 votes

AAA authentication for all users and a single user for local only?

This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens): aaa authentication login default local ...
Todd Wilcox's user avatar
  • 1,135
2 votes

Cisco: Return key needed after remote ssh console access using rotaries

There is a command for this: autoselect It´s explained in Cisco docs: Cisco Help The autoselect command bypasses the login prompt and enables the specified session to begin automatically. However, ...
Luis Andrés García's user avatar
1 vote

Cisco Mobility Express - supported authentication options

If you mean host to network attachment, then it works much like any other Cisco wireless products using WPA2 Personal (Pre-Shared Key) or WPA2 Enterprise (802.1X using RADIUS). If you mean logging ...
Ron Maupin's user avatar
  • 99.6k
1 vote
Accepted

Tacacs+ login asking ENABLE password & logs not working

I want to allow only fixed sets of CMD's for SUPPORT group. This issue is two-fold: You need to configure your device to use TACACS for authorization: (config)#aaa authorization commands 15 ... (...
John Jensen's user avatar
  • 9,037
1 vote
Accepted

ISE as RADIUS server or not in EAP-TLS authentication

Does the ISE server act as a RADIUS server to a Switch proxying a supplicant certificate, or does it use some other protocol? This is for EAP-TLS based auth Whenever you have an EAP based ...
YLearn's user avatar
  • 27.3k
1 vote

Prioritizing SSH, Telnet, TACACS in Cisco IOS

On Cisco devices running IOS, you can use the Quality of Service (QoS) features to prioritize different types of traffic based on Differentiated Services Code Point (DSCP) values. In your case, you ...
warashi nguyen's user avatar
1 vote

TACACS: multiple source interfaces

Not using a loopback address can cause many problems, as you will likely discover on your own ;-p The command you quote is used to specify the source interface, if I understand your question. You ...
Ron Trunk's user avatar
  • 67.5k
1 vote

Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable

On the ASA platform, each "A" in AAA is processed independently. Furthermore, each entry method for authentication is processed independently. So, you have TACACS setup for SSH and ASDM, ...
user3629081's user avatar
  • 1,008
1 vote

Limit Access to a Specific VRF?

Just to close this out, I worked with Cisco support to configure ACS to limit their access as much as possible but they did confirm that you cannot limit access to a VRF. I also asked them if I could ...
RSS's user avatar
  • 210
1 vote

CISCO Switch SSH Certificate via TACACS-Server

The short answer is no, because the SSH authentication happens before the login authentication (where the TACACS server is contacted). Even if it were possible to download the certificate, you would ...
Ron Trunk's user avatar
  • 67.5k

Only top scored, non community-wiki answers of a minimum length are eligible