SYSTEM ADMINISTRATOR GUIDE     71/1543-CRA 119 1170/1-V1 Uen B

Configuring TACACS+

Copyright

© Ericsson AB 2009–2010. All rights reserved. No part of this document may be reproduced in any form without the written permission of the copyright owner.

Disclaimer

The contents of this document are subject to revision without notice due to continued progress in methodology, design and manufacturing. Ericsson shall have no liability for any error or damage of any kind resulting from the use of this document.

Trademark List

Contents

1   Contents of This Document

This document provides an overview of the Terminal Access Controller Access Control System Plus (TACACS+) features supported on the SmartEdge router®, describes TACACS+ Attribute-Value Pairs, and describes the tasks used to configure, monitor, and administer TACACS+. This document also provides a configuration example of TACACS+.

2   Overview

The TACACS+ protocol enables building a system that secures remote access to networks and network services. TACACS+ is based on a client/server architecture. When configured with the IP address or hostname of a TACACS+ server, the SmartEdge router can act as a TACACS+ client. TACACS+ servers are configured on a per-context basis, with a limit of six servers in each context.

The SmartEdge router supports the TACACS+ features of One-Time Passwords in Everything (OPIE), S/Key, and SecurID, if they are supported by and enabled on the TACACS+ server. These functions are limited to Telnet sessions only.

The SmartEdge router uses Simple Network Management Protocol (SNMP) notifications when the SmartEdge router has difficulty communicating with a TACACS+ server and declares it down and also when communication to the server is restored.

Configurable options for a TACACS+ server include:

• Time-out interval, maximum number of retries, deadtime interval
• Domain stripping of structured user names
• Authenticating of administrators and authorizing the use of specific command-line interface (CLI) commands
• Sending of accounting messages for administrator sessions and CLI command accounting records to TACACS+ servers

To enable authentication and accounting features, you must also configure authentication, authorization, and accounting (AAA). For information about AAA tasks and commands, see Configuring Authentication, Authorization, and Accounting.

To enable administrator authentication through TACACS+, enter the aaa authentication administrator command (in context configuration mode). To configure CLI authorization, enter the aaa authorization commands command (in context configuration mode). To enable accounting messages to be sent to a TACACS+ server, enter the aaa accounting administrators and aaa accounting commands commands (in context configuration mode).

3   Configuration and Operations Tasks

The sections that follow provide information for configuring and operating TACACS.

3.1   Configuring TACACS+

Note:  

In this section, the command syntax in the task tables displays only the root command; for the complete command syntax, see Command List.

The SmartEdge router supports up to six TACACS+ servers in each context. Servers are assigned priority based on the order in which they are configured in the operating system. The first configured server is used first. If the first server becomes unavailable or unreachable, the second server is used, and so on.

By default, the local IP address for the interface on which TACACS+ is transmitted is included in packets sent by the SmartEdge router. To not publish the IP address to the TACACS+ server, you must configure a loopback interface to appear to be the source address for TACACS+ packets. The interface must be reachable by the TACACS+ server; for details about this command, see Configuring Contexts and Interfaces.

For information about configuring interfaces and the ip source-address command (in interface configuration mode), see Configuring Contexts and Interfaces.

3.2   Operations Tasks

To monitor and troubleshoot TACACS+ servers, perform the appropriate TACACS+ operations tasks described in Table 2. Enter the debug command in exec mode; enter the show command in any mode.

4   Configuration Examples

The following example configures a TACACS+ server IP address, 10.43.32.56, with the key, Secret. The SmartEdge router will attempt to open a TCP connection to the TACACS+ server up to 5 times when no response is received within 30 seconds:

[local]Redback(config-ctx)#tacacs+ server 10.43.32.56 key Secret

[local]Redback(config-ctx)#tacacs+ max-retries 5

[local]Redback(config-ctx)#tacacs+ timeout 30

[local]Redback(config-ctx)#tacacs+ strip-domain

5   TACACS+ Attribute-Value Pairs

Terminal Access Controller Access Control System Plus (TACACS+) attribute-value pairs (AVPs) are used to define specific administrator and command-line interface (CLI) command authentication, authorization, and accounting (AAA) elements for user profiles that are stored on a TACACS+ server.

5.1   TACACS+ Authentication and Authorization AVPs

Table 3 describes TACACS+ authentication and authorization AVPs supported by the SmartEdge router.

5.2   TACACS+ Administrator Accounting AVPs

Table 4 describes the TACACS+ administrator accounting AVPs supported by the SmartEdge router.

5.3   TACACS+ Command Accounting AVPs

Table 5 describes the TACACS+ command accounting AVPs supported by the SmartEdge router.