TACACS+ authentication question

[mjsully]

If I set our new Ciscoworks server to use TACACS+ as the login module, it allows any user with a TACACS account to login to the server with Help Desk priveleges. However, the Ciscoworks server is not defined as being a AAA client. How is the TACACS+ server authenticating without it being a defined client? I thought no device would be able to authenticate unless it was added first as a AAA client on the TACACS+ server? What am I missing here?

[mhoda]

Hello,

Yes, you are correct !! TACACS + Server should not authenticate the users from Cisco Works, if its not defined as a AAA client on the TACACS+ Server. I would check the Passed Authentication (you may need to turn it on on ACS Windows, its turned off by default) to see if its really authenticting against ACS Server. If it is, then my guess would be, there is a default AAA client defined with the same shared secrect key defined in the Cisco Works. Otherwise, it should not authenticate. What kind of TACACS+ Server are you using?

Thanks,

Mynul

[mjsully]

You are correct, there was a "default" config setup under the name "other" that had the same key as the TACACS+ server. Thanks for the help!