ACS and Tacacs on switches

[Network Pro]

Hi all,

Inorder for tacacs+ to work on switches, do we need to create an entry for these switches on the ACS server...because in my previous place of wor, my collegue configured tacacs without entering any on the acs server..is this possible?

Thanks

[srirmoha]

Hi There,

As far as the ACS 5.x is concerned, it's not possible to achieve this

without having the switch defined as a AAA client on the ACS.

You need to define this under Network Resources >> Network Devices and AAA

Clients. And once you add this here, mention the TACACS shared secret you

intend to use on the switch config for this TACACS server.

[Network Pro]

thanks for the reply...thats what i thought as well but definetly there was no indivigual entry of each switch ip address...any other thoughts on this?

[andamani]

Hi,

You will need to define a tacacs server on the switch.

On the ACS server you will need to define the Switch as a AAA client. This will make the ACS server listen to the requests coming from this Switch. Else the ACS server will drop the request giving a failure reason as "Unknown NAS"

Hope this helps.

Regards,

Anisha

P.S.: please mark this post as answered if you feel your query is resolved. Do rate helpful posts.

[srirmoha]

Hi,

Well you can either add one single switch as a host or the entire subnet under AAA clients on the ACS.

Probably your colleague had the entire subnet defined on the ACS, hence he needed not add each host one by one. They must have been automatically included in the subnet range.

I mean instead of adding a switch as 192.168.1.1 255.255.255.255 as a AAA client, he must have added it as 192.168.1.0 255.255.255.0. So all the hosts in this networks are added effectivel as AAA clients on the ACS 5.x.

Hope this helps.. and yes please mark this post as answered if you feel your query is resolved. Do rate helpful posts. :-)

[Network Pro]

Hi,

Thanks for all your replies. I figured out how this is done. There is an unassigned entry on the ACS where you edit it and just enter the key without any ipaddress or host name..if there is no unassigned then all you do is create another entry for AAA client and just enter the key without any ip address or hostname. on applying this, you will find this entry to change as others which means for all switches in the range

Thakns