Description

This article provides information on how to configure TACACS+ authentication.

Symptoms

 How to Configure TACACS+ authentication.

Solution

 

To use TACACS+ authentication on the router, configure information about one or more TACACS+ servers on the network, by including the tacplus-server statement at the [edit system] hierarchy level: 

[edit system]
tacplus-server server-address {
    port port-number;
    secret password;
    single-connection;
    timeout seconds;
}
  • The Server-address is the address of the TACACS+ server.

  • The port-number is the TACACS+ server port number
. You must specify a secret (password), which the local router or switch passes to the TACACS+ client, by including the secret statement. If the password includes spaces, enclose the password in quotation marks. The secret used by the local router or switch must match the secret being used by the server.

Optionally, you can specify the length of time, which the local router or switch waits to receive a response from a TACACS+ server, by including the timeout statement. By default, the router or switch waits for 3 seconds. You can configure this to be a value in the range from 1 through 90 seconds.

Optionally, you can have the software maintain one open Transmission Control Protocol (TCP) connection to the server for multiple requests, rather than opening a connection for each connection attempt, by including the single-connection statement.

By default, Junos uses the remote template accounts when:

  • The authenticated user does not exist locally on the router
  • The authenticated user’s record in the authentication server specifies local user, or the specified local user does not exist locally on the router


To configure the remote template account, include the user remote statement at the [edit system login] hierarchy level and specify the privileges, which you want to grant to remote users: 

[edit system login]

user remote {
         full-name "All remote users";
         uid uid-value;
         class class-name;
}
To configure different access privileges for users who share the remote template account, include the allow-commands and deny-commands commands in the authentication server configuration file.