topic the new Tacacs+ for Switches in Network Access Control

the new Tacacs+ for Switches

Bobby Roberts — Mon, 11 Mar 2019 01:33:45 GMT

I just upgraded my IOS to the latest but now the way i was inputing my Tacacs+ info is not working.

conf t

enable secret*****

username admin privilege 15 password 0 *******

aaa new-model

aaa authentication login default group tacacs+ enable local

aaa authentication enable default group tacacs+ enable

tacacs-server host*.*.*.* key *******

line con 0

line vty 0 4

line vty 5 15

end

But now it looks as if I need to set this up a bit diffrently, has anyone setup the new way? any pointers?

the new Tacacs+ for Switches

Nicolas Darchis — Fri, 18 Nov 2011 10:23:45 GMT

I know that you need to define the tacacs server a different way.

Tacacs server host (hit enter here)

Then you define the server ipv4/ipv6 address and credentials.

Nico

Re: the new Tacacs+ for Switches

andrestruwe — Fri, 18 Nov 2011 14:52:55 GMT

Hello,

I do have the same problem with the TACACS+ authentication after upgrading the IOS on my Catalyst C2960G.

It says that the command "tacacs-server host" is deprecated soon. I tried to reconfigure my startup-config according to this link: http://slaptijack.com/networking/new-style-tacacs-configuration/

Although my Switch is accepting the new command a warning message occurs after rebooting it:

%AAAA-4-NOSERVER: Warning: Server acs1.teas.bessy.de is not defined.

Here is an excerpt of my config:

---------------------------------------------------------------------------------

aaa new-model

aaa group server tacacs+ tac_admin

server name acs1

aaa authentication login default group tac_admin local

aaa authorization exec default group tac_admin local

tacacs server acs1

address ipv4 192.168.246.69

key 7 #############

---------------------------------------------------------------------------------

I don't know how to solve the problem.

Can anybody help?

André

Re: the new Tacacs+ for Switches

Bobby Roberts — Fri, 18 Nov 2011 22:32:27 GMT

Usualy I update once i've found the fix. or in other words I got it to work running this.

CONF T

aaa new model

tacacs server tacacs

address ipv4 *.*.*.*

key

exit

aaa authentication login default group tacacs+ enable local

aaa authentication login console group tacacs+ enable local

aaa authentication enable default group tacacs+ enable

But this didn't work right away, I acutally had to NO out the previous

tacacs-server IP ADDRESS PORT KEY

that was left from the old IOS. Once I NO'd out that, it worked like a charm

Re: the new Tacacs+ for Switches

andrestruwe — Mon, 21 Nov 2011 08:21:44 GMT

@Bobby Roberts,

thank you for your reply.

I'd already exchanged the old "tacacs-server IP ADDRESS PORT KEY" command with the new one like on the example given on this page: http://slaptijack.com/networking/new-style-tacacs-configuration/

So there isn't an old command left. Maybe there is something wrong in my config but I couldn't find any configuration example from Cisco.

Can't anybody help?

Re: the new Tacacs+ for Switches

andrestruwe — Thu, 24 Nov 2011 16:06:32 GMT

Although the warning message:

%AAAA-4-NOSERVER: Warning: Server acs1.teas.bessy.de is not defined.

still appears while rebooting the tacacs+ authentication works.

Re: the new Tacacs+ for Switches

Bobby Roberts — Fri, 25 Nov 2011 14:21:42 GMT

Andre - Can you e-mail me your whole config, Ill paste it on a switch here and see where the problem is. Bobby@Bobby4Hire.com

Re: the new Tacacs+ for Switches

andrestruwe — Mon, 28 Nov 2011 09:05:10 GMT

Hello Bobby,

I am sorry but I can't send you the whole config because it is a configuration of my company and the necessary part is this one:

aaa new-model

aaa group server tacacs+ tac_admin

server name acs1

aaa authentication login default group tac_admin local

aaa authorization exec default group tac_admin local

tacacs server acs1

address ipv4 192.168.246.69

key 7 #############

Despite this thanks for your help .