topic Re: How to configure TACACS for Cat6509-SUP2? in Network Access Control

How to configure TACACS for Cat6509-SUP2?

gilson_machado — Sun, 10 Mar 2019 14:21:26 GMT

I have a6509 with dual MSFC2 and dual SUP2. I am trying to implement TACACS on both. I would like to have fail over the local password if the TACACS server access fail. I need authentication and accounting.

What commands I should use? I tested some bute I am getting many erros. Is there any configuration sample available?

Re: How to configure TACACS for Cat6509-SUP2?

mhoda — Wed, 11 Jun 2003 20:37:24 GMT

Hi,

The minimum configuration required would be:

tacacs-server host 10.1.1.1 key cisco

aaa new-model

aaa authentication login default [group] tacacs+ local

aaa authorization exec default [group] tacacs+ local <--this is not needed if you just want to authenticate users and don't want to directly be dropped to the enable mode

If you don't want to add the above line and wants to do enable password authentication then you can do the following:

aaa authen enable default [group] tacacs+ enable

aaa accounting exec default start-stop group tacacs+ <--You can turn on accounting for other purpose also like command autho etc.

Before you enter these, plese make sure to create the local user database as follows:

username admin privilege 15 password admin

Thanks,

Mynul

Re: How to configure TACACS for Cat6509-SUP2?

gilson_machado — Thu, 12 Jun 2003 11:37:31 GMT

Hello Mynul!

I forgot to mention that it is a CatOS (using set commands).

The group of commands that I could find is the below:

set authentication login tacacs enable

set authentication enbale tacacs enable

set tacacs server x.x.x.x

set tacacs key yyyy

But it is not working properly.

Is there anything to add to that?

Regards,

Gilson

Re: How to configure TACACS for Cat6509-SUP2?

sghosh — Thu, 12 Jun 2003 16:00:17 GMT

Hi Gilson,

In case of switches with cat os there is no concept of local username, but it falls back to the local telnet and enable password.

If you are using 7.5.x code then you add a local user otherwise.

Here are the commands you need

set authentication login local enable

set authentication login tacacs enable

set tacacs server #.#.#.#

set tacacs key your_key

Here is a good link

http://www.cisco.com/warp/public/480/72.shtml

Thanks

Sujit

Re: How to configure TACACS for Cat6509-SUP2?

gilson_machado — Thu, 12 Jun 2003 18:18:27 GMT

Thanks Sujit!

looks like this is the correct set of commands.

Thanks everybody for the help.

Reagrds,

Gilson