|
|
|
|
TACACS provides access control for networked devices via one or more centralized servers. Similar to RADIUS, this protocol simplifies authentication by making use of a single database that can be shared by many clients on a large network. TACACS is based on the TACACS protocol (described in RFC1492) but additionally provides for separate authentication, authorization, and accounting services. The original protocol was UDP based with messages passed in clear text over the network; TACACS uses TCP to ensure reliable delivery and a shared key configured on the client and daemon server to encrypt all messages.
Use the tacacs-server host command in Global Configuration mode to configure a TACACS server. This command enters into the TACACS configuration mode. The <ip-address|hostname> parameter is the IP address or hostname of the TACACS server. To specify multiple hosts, multiple tacacs-server host commands can be used.
Use the tacacs-server host command to delete the specified hostname or IP address. The <ip-address|hostname> parameter is the IP address of the TACACS server.
Use the tacacs-server key command to set the authentication and encryption key for all TACACS communications between the switch and the TACACS daemon. The <key-string> parameter has a range of 0 - 128 characters and specifies the authentication and encryption key for all TACACS communications between the switch and the TACACS server. This key must match the key used on the TACACS daemon.
Text-based configuration supports TACACS server's secrets in encrypted and non-encrypted format. When you save the configuration, these secret keys are stored in encrypted format only. If you want to enter the key in encrypted format, enter the key along with the encrypted keyword. In the show running config command's display, these secret keys are displayed in encrypted format. You cannot show these keys in plain text format.
Use the no tacacs-server key command to disable the authentication and encryption key for all TACACS communications between the switch and the TACACS daemon. The <key-string> parameter has a range of 0 - 128 characters This key must match the key used on the TACACS daemon
Use the tacacs-server key-string command to set the global authentication encryption key used for all TACACS communications between the TACACS server and the client.
Use the tacacs-server timeout command to set the timeout value for communication with the TACACS servers. The <timeout> parameter has a range of 1-30 and is the timeout value in seconds.
Use the tacacs-server timeout command to restore the default timeout value for all TACACS servers.
Use the show tacacs command to display the configuration and statistics of a TACACS server.
The display parameters for above command are:
Use the show tacacs statistics to display information about the server statistics.
The display parameters for above command are: