Here is what you need to configure on nexus for enabling Tacacs+
Enable TACACS+, then provide the IP address of the TACACS+ Server (ACS):
feature tacacs+
tacacs−server host x.x.x.x
tacacs-server host y.y.y.y
tacacs−server directed−request
tacacs−server key 7 KEY
aaa group server tacacs+ ACS
server x.x.x.x
server y.y.y.y
use−vrf management ( only if configured)
source−interface mgmt0 ( should be defined on the ACS as well)
>> You can test the authentication with the below listed command:
test aaa group ACS username password
If you see authentication REJECT OR SUCCESSFUL then that would mean it's reachable.
Configure login authentications:
aaa authentication login default group ACS
aaa authentication login console group ACS
aaa accounting default group ACS
Nexus by-default supports role-based-access that is somehow servers the pupose of authorization. Here is an example that you may go through- https://supportforums.cisco.com/docs/DOC-14273
In case you'd like to use command authorization, like you have setup for IOS then please use the below listed commands:
This example shows how to authorize EXEC mode commands with TACACS+ server group tac1
switch# aaa authorization commands default group ACS
This example shows how to authorize configuration mode commands with TACACS+ server group tac1
If the server is reachable, the command is allowed or not allowed based on the server response.
If there is an error reaching the server, the command is authorized based on the user's local role.
switch(config)# aaa authorization config-commands default group ACS local
NOTE: Since this part involves command authorization, I would suggest you to test the config in TEST enviornment before you implement in production to avoild lockout issues.
Nexus Guide check here
Hope it helps.
~BR
Jatin Katyal
**Do rate helpful posts**
~Jatin
