Configuring Tacacs+; About Tacacs+; About Tacacs+ Server Default Configuration - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Chapter 32 Configuring RADIUS and TACACS+
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Configuring TACACS+

A Cisco MDS switch uses the Terminal Access Controller Access Control System Plus (TACACS+)
protocol to communicate with remote AAA servers. You can configure multiple TACACS+ servers and
set timeout values.
This section includes the following topics:
•
•
•
•
•
•
•
•
•
•
•
•
•
•

About TACACS+

TACACS+ is a client/server protocol that uses TCP (TCP port 49) for transport requirements. All
switches in the Cisco MDS 9000 Family provide centralized authentication using the TACACS+
protocol. The TACACS+ has the following advantages over RADIUS authentication:
•
•
•

About TACACS+ Server Default Configuration

Fabric Manager allows you to set up a default configuration that can be used for any TACACS+ server
that you configure the switch to communicate with. The default configuration includes:
•
•
•
•
OL-16184-01, Cisco MDS SAN-OS Release 3.x
About TACACS+, page 32-17
About TACACS+ Server Default Configuration, page 32-17
About the Default TACACS+ Server Encryption Type and Preshared Key, page 32-18
Enabling TACACS+, page 32-18
Setting the TACACS+ Server Address, page 32-18
Setting the Global Secret Key, page 32-20
Setting the Timeout Value, page 32-20
About TACACS+ Servers, page 32-21
Sending TACACS+ Test Messages for Monitoring, page 32-24
Password Aging Notification through TACACS+ Server, page 32-24
About Users Specifying a TACACS+ Server at Login, page 32-24
Allowing Users to Specify a TACACS+ Server at Login, page 32-25
Defining Custom Attributes for Roles, page 32-25
Displaying TACACS+ Server Details, page 32-26
Provides independent, modular AAA facilities. Authorization can be done without authentication.
Uses the TCP transport protocol to send data between the AAA client and server, making reliable
transfers with a connection-oriented protocol.
Encrypts the entire protocol payload between the switch and the AAA server to ensure higher data
confidentiality. The RADIUS protocol only encrypts passwords.
Encryption type
Preshared key
Timeout value
Number of retransmission attempts
Cisco MDS 9000 Family CLI Configuration Guide
Configuring TACACS+
32-17