9
votes
Accepted
Authenticate ssh key via Cisco ACS (TACACS+)
It looks like, "No". There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload could suffice. (the RFC is a decade old) The real question is if ACS has ...
9
votes
Accepted
How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?
UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev)
UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269,...
6
votes
Accepted
Can you only allow local login when TACACS is unavailable on a Juniper?
This is actually default behavior.
The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS).
So in your case, the only time your local ...
5
votes
Accepted
AAA authentication for all users and a single user for local only?
Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely.
username localadmin password ...
5
votes
PLEASE HELP with TACACS with AD auth (error: Expected 'service', but got 'servive')
You misspelled the word service:
default servive = permit
4
votes
Accepted
TACACS+ AAA over L2L VPN
In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA ...
4
votes
TACACS+ AAA over L2L VPN
Your configuration
aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10
key testing123
defines the inside interface as the source.
4
votes
Accepted
AAA Authorization on IOS
Edited:
You use the group tacacs+ for your authentication, but you have not configured a server group for that. Here is a corrected configuration:
aaa authentication login default group HQTACACS ...
3
votes
Accepted
Access TACACS+ Server through ASA
On your router, all of your static routes pointing to your firewall are wrong. You need to define the next hop since you aren’t on a PTP link.
Please remove all of the routes pointing to Eth0/1 using ...
3
votes
Accepted
Tacacs+ over VPN is not working
You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your ...
3
votes
Accepted
Config comments logging on Cisco devices via Tacacs+
Two methods for this: one is a trick for where to put comments, the second is the syslog+git approach to looking after the configurations which one of my clients uses.
Method 1: ACL with comments
I ...
3
votes
tacacs server hostname problem
It's a warning that you are using an old, soon to be removed, configuration syntax, and gives you the new command. There are plenty of guides on the subject; Ron pointed out one of them.
3
votes
enable additional commands centrally for IOS privilege levels other than 15
Yes, this is the exact purpose of the second "a" in "aaa". Authorization is the process of limiting which commands a user is able to execute based on their user/group profile.
There are many ...
2
votes
Accepted
TACACS Implentation server key error
To answer your question: Yes. ;)
Problem solution is actually easy, as it turns out - I will be quoting what I found out:
The NX-OS password scheme is a normal rotation cipher. This is the sequence:
...
2
votes
Limit Access to a Specific VRF?
Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's ...
2
votes
AAA authentication for all users and a single user for local only?
This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens):
aaa authentication login default local ...
2
votes
Cisco: Return key needed after remote ssh console access using rotaries
There is a command for this: autoselect
It´s explained in Cisco docs:
Cisco Help
The autoselect command bypasses the login prompt and enables the specified session to begin automatically. However, ...
2
votes
Accepted
Cisco TACACS authentication config
The config you've posted is pretty common, and I suppose it was developed to be as flexible as possible, with separate methods for VTY and console access, as well as separate command authorization for ...
2
votes
Accepted
How does Tacacs server forward the credentials from client to Authentication server?
RADIUS was designed to authenticate and log dial-up remote users to a
network, and TACACS+ is used most commonly for administrator access to
network devices like routers and switches.
http://www....
1
vote
Cisco Mobility Express - supported authentication options
If you mean host to network attachment, then it works much like any other Cisco wireless products using WPA2 Personal (Pre-Shared Key) or WPA2 Enterprise (802.1X using RADIUS).
If you mean logging ...
1
vote
Accepted
Tacacs+ login asking ENABLE password & logs not working
I want to allow only fixed sets of CMD's for SUPPORT group.
This issue is two-fold:
You need to configure your device to use TACACS for authorization:
(config)#aaa authorization commands 15 ...
(...
1
vote
Accepted
ISE as RADIUS server or not in EAP-TLS authentication
Does the ISE server act as a RADIUS server to a Switch proxying a supplicant certificate, or does it use some other protocol? This is for EAP-TLS based auth
Whenever you have an EAP based ...
1
vote
TACACS: multiple source interfaces
Not using a loopback address can cause many problems, as you will likely discover on your own ;-p
The command you quote is used to specify the source interface, if I understand your question. You ...
1
vote
Limit Access to a Specific VRF?
Just to close this out, I worked with Cisco support to configure ACS to limit their access as much as possible but they did confirm that you cannot limit access to a VRF.
I also asked them if I could ...
1
vote
CISCO Switch SSH Certificate via TACACS-Server
The short answer is no, because the SSH authentication happens before the login authentication (where the TACACS server is contacted).
Even if it were possible to download the certificate, you would ...
1
vote
After configuring tacacs cannot access to cli
The instant you enter aaa authorization commands, TACACS applies to every command you enter. If you aren't authenticated by TACACS, you will be unable to do anything. If the tacacs server(s) aren't ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
tacacs × 36cisco × 16
aaa × 14
authentication × 9
cisco-ios × 7
authorization × 6
ssh × 5
cisco-asa × 4
switch × 3
vpn × 3
radius × 3
vrf × 3
router × 2
juniper-junos × 2
acl × 2
accounting × 2
juniper × 1
cisco-catalyst × 1
security × 1
packet-tracer × 1
cisco-commands × 1
interface × 1
tunnel × 1
juniper-srx × 1
cisco-nx-os × 1