Cisco Systems IE 2000 Configuring TACACS+

12-30
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 12 Configuring Switch-Based Authentication
How to Configure Switch-Based Authent ication
Logging Into and Exiting a Privilege Level
Configuring TACACS+
This section describes how to configure your switch to support TACACS+. At a minimum, you must
identify the host or hosts maintaining the TACACS+ daemon and define the method lists for TACACS+
authentication. You can optionally define method lists for TACACS+ authorization and accounting. A
method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts
on a user. You can use method lists to designate one or more security protocols to be used, thus ensuring
a backup system if the initial method fails. The software uses the first method listed to authenticate, to
authorize, or to keep accounts on users; if that method does not respond, the software selects the next
method in the list. This process continues until there is successful communication with a listed method
or the method list is exhausted.
Identifying the TACACS+ Server Host and Setting the Authentication Key
Command Purpose
enable level Logs in to a specified privilege level.
level—The range is 0 to 15.
disable level Exits to a specified privilege level.
level—The range is 0 to 15.
Command Purpose
Step 1 configure terminal Enters global configuration mode.
Step 2 tacacs-server host hostname [port
integer] [timeout integer] [key string]
Identifies the IP host or hosts maintaining a TACACS+ server. Enters this
command multiple times to create a list of preferred hosts. The software
searches for hosts in the order in which you specify them.
• hostname—Specifies the name or IP address of the host.
• (Optional) port integer—Specifies a server port number. The default
is port 49. The range is 1 to 65535.
• (Optional) timeout integer—Specifies a time in seconds the switch
waits for a response from the daemon before it times out and declares
an error. The default is 5 seconds. The range is 1 to 1000 seconds.
• (Optional) key string—Specifies the encryption key for encr ypting
and decrypting all traffic between the switch and the TACACS+
daemon. You must configure the same key on the TACACS+ daemon
for encryption to be successful.
Step 3 aaa new-model Enables AAA.
Step 4 aaa group server tacacs+ group-name (Optional) Defines the AAA server-group with a group name.
This command puts the switch in a server group subconfiguration mode.