Description

This article provides information about the configuration for TACACS Plus.

Symptoms

Information about the configuration for TACACS Plus.

Solution

To configure TACACS Plus, perform the following procedure:
 

  1. Enable the authentication order for Tacacs Plus as the first priority:
    user@switch #set system authentication-order tacplus
  2. Enable the authentication order for the Local Password as the second priority:
    user@switch #set system authentication-order password
  3. Configure the host IP and port for Tacacs Plus:
    user@switch #set system tacplus-server 10.1.110.150 port 49
  4. Secret shared with ACS (Cisco123):
    user@switch #set system tacplus-server 10.1.110.150 secret “$ABC123"
  5. Set the fall back time of Tacacs Plus to the local password database:
    user@switch #set system tacplus-server 10.1.110.150 timeout 5
  6. Define the Management IP source to ACS:
    user@switch #set system tacplus-server 10.1.110.150 source-address 10.96.105.208
  7. Enable ACS accounting for specific events:
     
    • user@switch #set system accounting events login
    • user@switch #set system accounting events change-log
    • user@switch #set system accounting events interactive-commands
  8. Configure the IP address for the ACS Accounting server:
    user@switch #set system accounting destination tacplus server 10.1.110.150 secret “$ABC123"
  9. Configure the IP address for the ACS Accounting server to the device management IP:
    user@switch #set system accounting destination tacplus server 10.1.110.150 source-address 10.96.105.208

Modification History

2020-02-23: Changed encrypted password to “$ABC123".