cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

6426
Views
0
Helpful
2
Replies
Highlighted
Cisco Employee

TACACS+ authentication and authorization on IOS XR

Hi all,

I've been trying to connect several IOS-XR devices on our lab (ASR's, GSR's and CRS's) to our TACACS+ server (Cisco Secure ACS, release 4.2(0)). The goal is that the TACACS will manage user authentication and command authorization for all CLI, non-console login types (telnet and SSH). I use no HTTP server access to the devices and I'd like to keep the console login to local credentials.

I've got many IOS devices connected to that TACACS with the following AAA-related configuration. I'd like to implement the same principles on the IOS-XR's, but since the command structure is different and I couldn't figure out how to do this using the manual, I require your expert help:

aaa new-model

!

!

aaa group server tacacs+ acs-servers-group

server <TACACS-IP-ADDRESS>

!

aaa authentication login default local

aaa authentication login local_vty local

aaa authentication login console local

aaa authentication login acs group acs-servers-group local

aaa authorization exec default group tacacs+

aaa authorization commands 15 acs_cmds group tacacs+

aaa authorization commands 15 local_cmds none

!

!

!

!

!

aaa session-id common

!

skipped...

!

username ******** privilege 15 secret 5 *************************************

!

skipped...

!

tacacs-server host <TACACS-IP-ADDRESS> key 7 ***************

tacacs-server directed-request

!

skipped...

!

line con 0

stopbits 1

line aux 0

stopbits 1

line vty 0 4

exec-timeout 0 0

privilege level 15

authorization commands 15 acs_cmds

login authentication acs

transport preferred telnet

transport input all

line vty 5 15

exec-timeout 0 0

* Note: IOS-XR device run 4.1.2 and 4.2.0 versions

Thanks a lot for all help you could provide

Lior

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Advocate

Lior,

 

You need to send back the task ids and/or task groups in order to make this work. From my experience working with these platforms is that you do not really need to perform command authorization if you trust the task-ids/groups that are built into the ASR.

 

The flow for tacacs command auth for these devices is a little different than your traditional IOS (unless something has changed in the last 6 months), basically if the user tries to execute a command, the tacacs command auth is only triggered if the user is running a command that falls within his/her task umbrella. If it is not there then the command authorization is never triggered.

 

Here is some documentation that I feel will help you:

 

https://supportforums.cisco.com/docs/DOC-15944

 

Thanks,

Tarik Admani
*Please rate helpful posts*

View solution in original post

2 REPLIES 2
Highlighted
Advocate

Lior,

 

You need to send back the task ids and/or task groups in order to make this work. From my experience working with these platforms is that you do not really need to perform command authorization if you trust the task-ids/groups that are built into the ASR.

 

The flow for tacacs command auth for these devices is a little different than your traditional IOS (unless something has changed in the last 6 months), basically if the user tries to execute a command, the tacacs command auth is only triggered if the user is running a command that falls within his/her task umbrella. If it is not there then the command authorization is never triggered.

 

Here is some documentation that I feel will help you:

 

https://supportforums.cisco.com/docs/DOC-15944

 

Thanks,

Tarik Admani
*Please rate helpful posts*

View solution in original post

Highlighted

Thanks Tarik,

I'll give it a try and report back.

Lior

Content for Community-Ad