topic Re: TACACS+ server config file example in Network Access Control

TACACS+ server config file example

devang_etcom — Wed, 14 Oct 2020 20:33:25 GMT

Hello All,

Can anyone share few example files of tacacs+ server?

Can we configure the tacacs server to allocate privilege level (5-7) with option of allowing few configuration parameters under the interface? For example privilege level 5 user should be able to run all show, clear, show tech commands and they should have authorization to shutdown and no shutdown capabilities along with duplex change. Wondering what would tacacs+ server config file would look like?

I don't want to give user privilege level of 15 to have full configuration control.

Re: TACACS+ server config file example

Aref Alsouqi — Wed, 14 Oct 2020 21:15:22 GMT

Are you using ISE as your TACACS server?

Re: TACACS+ server config file example

devang_etcom — Wed, 14 Oct 2020 21:30:25 GMT

no its different TACACS+ server/software.

Re: TACACS+ server config file example

balaji.bandi — Wed, 14 Oct 2020 21:40:52 GMT

Look at the below example : ( add your own commands, if you doing local, you need to do hard work to all commands)

https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13860-PRIV.html

Re: TACACS+ server config file example

Aref Alsouqi — Wed, 14 Oct 2020 22:31:48 GMT

On your TACACS server you need to define the shell profiles for each privilege level, and associate them with the respective privilege levels. On the network device side, the most relevant commands for authorization would be:

aaa new-model

aaa group server tacacs+ TACACS
server <TACACS primary IP>
server <TACACS secondary IP>

aaa authorization config-commands
aaa authorization exec default group TACACS local
aaa authorization commands 0 default group TACACS local
aaa authorization commands 1 default group TACACS local
aaa authorization commands 5 default group TACACS local
aaa authorization commands 15 default group TACACS local

Re: TACACS+ server config file example

devang_etcom — Mon, 02 Nov 2020 00:08:01 GMT

I wasn't looking for router/sw config!

Re: TACACS+ server config file example

devang_etcom — Mon, 02 Nov 2020 00:09:34 GMT

I found not exact but close by on one of the older cisco external community email discussion.

Re: TACACS+ server config file example

thomas — Sun, 08 Nov 2020 05:26:16 GMT

There are MANY examples of TACACS configuration at ISE Device Administration resources for TACACS+ and RADIUS with both documents and videos.