Basic AAA Configuration on IOS

I should point out that rather than using a tacacs authorization line, you could simply have an enable "user" in your tacacs_plus.conf file called $enab15$, which would dictate the routers enable password.

You'd use this in your IOS config:

aaa authentication enable default group tacacs+ local

Check out our good friend @brandoncarroll's Cisco Access Control Security: AAA Administration Services book for lots more information on AAA.

@stretch Yes, you'd need to type the enable command. I suppose there's no real advantage of doing that, besides the ability to have multiple enable levels. I guess it's just an option for having more granular authentication.

Or, perhaps a scenario where you have many people who can log into your routers, but only a select few who can configure them? Of course that could be done with in your tac_plus configuration, but this way might be a bit easier to configure and manage.

Obviously not saying my suggestion is the way to go, I just wanted to mention the option.

@Calvin It's as simple as:

radius-server host x.x.x.x key 

aaa authentication login default group radius local

Hope that helps.

I figured I'd also give an example of a tac_plus.conf file, for those who may want to go that route.

On a FreeBSD system, simply use:

cd /usr/ports/net/tac_plus4 && make install

Once installed, configure your /usr/local/etc/tac_plus.conf file:

# /usr/local/etc/tac_plus.conf

# Your TACACS+ key here. You need to specify this in your IOS config too.
key="7e@#fsdf*6Sf3a!"

# Set TACACS+ log file location
accounting file = /var/log/tacacs.log

# Create a user, make them a member of "netadmins"
user=tacacsuser {
        name = "TACACS User"
        login = des "a8Dpo4M5FR30s"
        member = netadmins
}

# Set IOS enable password
user=$enab15$ {
        login = des "5Ro7GV4eq2Arc"
}

# Create the "netadmins" group, with default permit command authorization
group=netadmins {
        default service = permit
}

Add tac_plus to your /etc/rc.conf:

echo 'tac_plus_enable = "YES"' >> /etc/rc.conf

Then start tac_plus:

/usr/local/etc/rc.d/tac_plus start

Enjoy!

Just wanted to add that while the TACACS+ protocol is secure the Radius isn't. Therefore it is very easy to sniff the payload of the Radius communication and grab whatever is in there.

However Radius is often the de facto protocol if the authentication/authorisation is against Active Directory through the Microsoft IAS.

Thanks for another great article. Two points:

1. I avoided the $enab15$ user in our config as it is a known username. We adopted the same approach that Stretch advocates and it works well.
2. IIRC we did have some issues whereby using two tacacs servers resulted in our being locked out on network failure. The device tried them in turn ad infinitum. Has anyone else experienced this?
3. ASAs and WLCs work a little differently. I wrote this up a couple of years ago: http://users.ox.ac.uk/~guym/. I now opt for tacacs first, then local but other than that our config hasn't changed much and still works with later ASA images.

Hi,

are there any free tacacs servers?

I used Cisco ACS and it works well but it is to expensive.

Some comments. It's a bit confusing to use default method. The better practice is using named methods for defined purposes. This makes a configuration to be easy to understand.

For me advantage of tacacs is accounting ability. It's not covered in the article. You can know not only who is managing equipment, but also what is done on it.

aaa accounting commands 15 VTY start-stop group tacacs+

Nice, I'm working through CCNA Security.

Thanks for the blog.

Bits of experience from environment I work in:

You can type or paste aaa configuration (source-interface, tacacs-server host(s), aaa commands) first - except for "tacacs-server key ". Leave this as last one. This way you can add whole aaa command set without fear of being stopped as unathorised in the middle due to AAA already taking place. It won't let you finish configuration unless you re-log with valid tacacs username and password. There is no communication with server if you do not put key in. This applies mostly to templates you paste configs from and methods you or your customer wants to use.

If for some reason tacacs server is running on different port put basic command first "tacacs-server host 192.168.1.1" and after finishing configuration change it to "tacacs-server host 192.168.1.1 port 4949" else you get error message not allowing you to configure port in first step.

Also it's good to have some sort of backdoor while configuring it, because with misconfigured aaa you can easily lock out of your router. This is no problem when router is sitting in front of you or you have tech support on site, but sometimes you're working remotely without somebody being physically present there. Find some way to squeeze "no aaa new-model" in and start again, eg. via snmp or opening second session with config mode. Worst case put "reload in 10" before you start fiddling with aaa.

Free TACACS server here

http://www.shrubbery.net/tac_plus/

Hi there,

If you use the aaa authentication enable list in conjunction with RADIUS and cisco catalyst switches, i find that the failover to the local account will not work. Even if the switch is isolated from the network.

Using just the login list like you have here for tacacs+ works equally well with radius.

cheers,
nikonau

Hi Team,

I have two Cisco ACS .i want to configure primary and secondary on router.

Kindly share the configuartion.

Cureent configuration i have configur

tacas server 1.1.1.1 key * tacacs server 2.2.2.2 key

but that one is not working as failover.if one down i we are not able to login via secondary..

Share configuration both on router and ACS gui.

Tusahr Naik tushar14029@ gmail.com

"The word default is used in lieu of a custom name for the list" This is true but I have seen another explanation of the use of default - as in this is the default list, which may also be true, but misses and important fact and that is, according to Cisco "using the list default in the aaa authentication login command, login authentication is automatically applied for all login connections (such as tty, vty, ! console and aux)."

I take from this that if I name my list "default" then then "aaa authentication command " applies to all places where login is possible.

Just to complicate things I note that with just AAA New-Model, a local user, but no AAA authentication login ..... statement, login still works.

All of this looks good, only I would add the testing capability to the overall methodology to allow for immediate feedback for the user without needing to test by using another login.

"test aaa group tacacs+ username password legacy"

Congratulations Jeremy !

Your post is really good.

I learn so much from your blogs and discussions boards. Your explanation are well easy to comprehend. This site has contributed greatly to my success.

Thank you Jeremy