topic TACACS+ timeouts in Network Security

TACACS+ timeouts

slevesqu — Thu, 25 Jan 2018 14:51:07 GMT

Hi team,

Can you indicate what timeouts are used by default relative to TACACS+ authentication and authorization and if they are configurable? The only parameters that seem to be configurable are in Device Administration -> Settings but they are not well documented. Basically I want to understand if the authentication credentials will be cached and how long to prevent an authentication request for each command authorized on the network device:

Thanks

Re: TACACS+ timeouts

kthiruve — Fri, 26 Jan 2018 00:09:36 GMT

Hi,

It depends on what authentication type you are using. ISE also has Identity caching.

Here are couple of relevant links to the topic

ACS to ISE: Enable Passcode Caching

and

Cisco Identity Services Engine Administrator Guide, Release 2.1 - Manage Users and External Identity Sources [Cisco Ide…

Apart from that these are the timeouts that can be configured there are rate limits and connection limits that can be configured in CLI but should be used with great care.

Thanks

Krishnan