topic Re: TACACS+ authentication question in Network Access Control

TACACS+ authentication question

mjsully — Sun, 10 Mar 2019 14:50:29 GMT

If I set our new Ciscoworks server to use TACACS+ as the login module, it allows any user with a TACACS account to login to the server with Help Desk priveleges. However, the Ciscoworks server is not defined as being a AAA client. How is the TACACS+ server authenticating without it being a defined client? I thought no device would be able to authenticate unless it was added first as a AAA client on the TACACS+ server? What am I missing here?

Re: TACACS+ authentication question

mhoda — Fri, 04 Jun 2004 21:16:46 GMT

Hello,

Yes, you are correct !! TACACS + Server should not authenticate the users from Cisco Works, if its not defined as a AAA client on the TACACS+ Server. I would check the Passed Authentication (you may need to turn it on on ACS Windows, its turned off by default) to see if its really authenticting against ACS Server. If it is, then my guess would be, there is a default AAA client defined with the same shared secrect key defined in the Cisco Works. Otherwise, it should not authenticate. What kind of TACACS+ Server are you using?

Thanks,

Mynul

Re: TACACS+ authentication question

mjsully — Mon, 07 Jun 2004 11:30:03 GMT

You are correct, there was a "default" config setup under the name "other" that had the same key as the TACACS+ server. Thanks for the help!