topic Re: same host for radius and tacacs in Network Access Control

same host for radius and tacacs

be04376 — Sun, 10 Mar 2019 22:38:24 GMT

Hi,

can i put a host (asa for example) twice in the acs server? one for tacacs to grant exec access to administrators and one for radius to authenticate the remote users.

I dont want remote users to be able to get exec mode.

Or how should i configure this ?

Re: same host for radius and tacacs

cisco24x7 — Mon, 04 Feb 2008 19:18:32 GMT

CiscoPix# sh run | inc aaa

aaa-server ABC protocol tacacs+

aaa-server ABC (outside) host 192.168.1.1

aaa-server TEST protocol tacacs+

aaa-server TEST (outside) host 192.168.1.1

aaa-server funk protocol radius

aaa-server funk (outside) host 192.168.1.1

aaa authentication enable console ABC LOCAL

aaa authentication ssh console ABC LOCAL

aaa authentication http console LOCAL

aaa accounting command ABC

aaa accounting ssh console ABC

aaa accounting telnet console ABC

aaa accounting serial console ABC

aaa accounting enable console ABC

It's all in the tag (i.e. ABC, TEST, funk)

CCIE Security

Re: same host for radius and tacacs

Jagdeep Gambhir — Tue, 05 Feb 2008 03:26:32 GMT

Yes, you can do it. ON acs network configuration

add

ASA---> 10.1.1.1----> Auth using tacacs+

ASA1-->10.1.1.1---->Auth using Radius

Host name can't be same.

Regards,

~JG

Do rate helpful posts