John,
We have a very large Juniper deployment (T-series, MX-series, etc). We use Cisco ACS and TACACS to manage these devices. The configuration on the ACS is fairly simple. You'll want to create login users and map them to classes on your JUNOS routers. Here is an example:
set system login user Engineering uid 2000
set system login user Engineering class Engineering-Class
set system login user NOC uid 2001
set system login user NOC class NOC-Class
set system login class Engineering-Class idle-timeout 15
set system login class Engineering-Class permissions all
set system login class NOC-Class idle-timeout 15
set system login class NOC-Class permissions view
set system login class NOC-Class permissions view-configuration
We use two classes, and Engineering and NOC. One is set as a read-write and the latter read-only. This in turn is then mapped in ACS (in our case version 4.2) either via user or group (preferably). First you modify the interface configuration and add a tacacs service as junos-exec and leave the protocol field blank. Next you modify the group with the proper user attributes. I've attached screen shots for both to this thread.
Hopefully this helps.
Derek
