topic Re: 802.1x and TACACS+ in Network Access Control

802.1x and TACACS+

MITCH JOHNSON — Sun, 10 Mar 2019 21:43:37 GMT

I use the ACS box mainly for AAA on the switches and routers using tacacs. Now we're looking at the possibility of using 802.1x, my early reading tell me I have to use RADIUS, but I'm using TACACS, can I have ttow different methods of authentication on the same switch/router?

Any help would be greatly appreciated.

Thanks.

Re: 802.1x and TACACS+

akemp — Fri, 25 Aug 2006 11:21:09 GMT

Yes you can. You specify which interfaces use which protocol in what order.

Re: 802.1x and TACACS+

jafrazie — Fri, 25 Aug 2006 11:39:30 GMT

Yes, you have to run RADIUS for 1X, but you can enable both just fine.

Re: 802.1x and TACACS+

MITCH JOHNSON — Fri, 25 Aug 2006 12:07:43 GMT

Is there an example config where both are shown? Each time I add a radius command it erases a radius command, but then I am doing the defaults and nothing specific.

Thanks.

Re: 802.1x and TACACS+

jafrazie — Fri, 25 Aug 2006 14:07:27 GMT

Not sure what you mean, but here's an example with 2 servers:

aaa group server tacacs+ mgmt_access

server 10.10.10.2

server 10.10.10.3

aaa group server radius dot1x_access

server 10.10.10.2

server 10.10.10.3

aaa authentication login VTY group mgmt_access enable

aaa authentication dot1x DOT1X group dot1x_access

Re: 802.1x and TACACS+

pbunet — Thu, 28 Sep 2006 10:57:03 GMT

Hi ,

Yes you can have different authentication methods on the same router/switch .

In case if you need to configure 802.1x you can simply add the 802.1x commands as they will not interfare in the working of your tacacs authentication .

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a00801f0a44.html

If you want to configure radius for login authentication along with exsisting Tacacs then you need to configure method list .

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7a8.html#wp1000906

Regards,

Puneet

Re: 802.1x and TACACS+

Wilson Samuel — Wed, 24 Jan 2007 15:54:13 GMT

Hi Puneet,

I'm also stuck with the same problem. I understand that a Router/Switch could be configured to use both the protocols get authenticated, however I don't see if the same is possible with any of the ACS Servers?

Or in other words, if I have to use the dot1x and the TACACS for enable purposes, I have to use 2 differnt ACS Servers, one with RADIUS and second with the TACACS+ protocol.

Plesae correct me if I'm wrong.

Regards,

Wilson Samuel

Re: 802.1x and TACACS+

MITCH JOHNSON — Wed, 24 Jan 2007 16:51:22 GMT

You do have to have two entries in the ACS box. So here's how I did it, I named one entry switch1 and the other entry switch1-radius. On the switch1 I selected tacacs on the switch1-radius I selected RADIUS (CISCO IOS PIX).

Restarted the service and it didn't complain a bit and it works fine.

Re: 802.1x and TACACS+

Wilson Samuel — Wed, 24 Jan 2007 17:59:03 GMT

Wow.. such a simple thing never clicked in my brain.. Thanks a lot!!!