7-10
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 7 Administering the Switch
Controlling Switch Access with TACACS+

Logging into and Exiting a Privilege Level

Beginning in privileged EXEC mode, follow these steps to log in to a specified privilege level and to exit
to a specified privilege level:

Controlling Switch Access with TACACS+

This sec tio n describe s how to enab le an d co nfig ur e Termina l Access Contr ol ler Acces s Con tr ol Sys tem
Plus (TACACS+), which provides detailed accounting information and flexible administrative control
over authentication and authorization processes. TACACS+ is facilitated through authentication,
authorization, accounting (AAA) and can be enabled only thr ough AAA com mands.
Note For comple te syntax an d usage infor mation for the commands us ed in this sectio n, refer t o the Cisco IOS
Securi ty Com mand R eference for R elease 1 2.1 .
This se ctio n c onta ins thi s configu ratio n inf or mat ion:
•Understa ndin g TACACS+, page 7-10
•TACACS+ Operat ion, page 7-1 2
•Configuring TACACS+, page 7 -12
•Displayin g the TACACS+ Configuration, page 7-17

Understanding TACACS+

TACACS+ is a security application that provides centralized validation of users attempting to gain
access to your switch. TACACS+ services are maintained in a database on a TACACS+ daemon
typically ru nning on a UN IX or Windows NT workst ation. You sh ould have access to a nd sho ul d
configure a TACACS+ server before the c onfiguring TACACS+ featur es on yo ur sw itc h.
TACACS+ provides for separate and modular authentication, authorization, and accounting facilities.
TACACS+ allows for a single access control server (the TACACS+ daemon) to provide each
service—authentica tion, authorization , and accounting —independently . Each service can be tie d into its
own database t o ta ke advantage of o th er se rvice s available on t hat server or on t he ne twork , de pe nding
on the capabilities of the daemon.
The goal of TA CA CS+ is to pro vide a method for managing mu ltiple network access poin ts from a single
manageme nt ser vice. Your swi tch can b e a net work a cce ss server al ong with oth er Ci sco rou ter s a nd
access servers. A network acc ess server provi des c onn ect ions to a si ngle user, to a ne twork or
subnetwo rk, a nd to int erco nne cted ne twork s a s sh own in Figure 7-1.
Command Purpose
Step 1 enable level Log in to a specified privilege level.
For level, the range is 0 to 15.
Step 2 disable level Exit to a specified privilege level.
For level, the range is 0 to 15.