Tacacs; Tacacs+ Configuration Example - D-Link DWS-3000 Series Configuration Manual

20

TACACS+

TACACS+ (Terminal Access Controller Access Control System) provides access control for
networked devices via one or more centralized servers. Similar to RADIUS, this protocol
simplifies authentication by making use of a single database that can be shared by many
clients on a large network. TACACS+ is based on the TACACS protocol described in
RFC1492. TACACS+ uses TCP to ensure reliable delivery and a shared key configured on the
client and daemon server to encrypt all messages.
After you configure TACACS+ as the authentication method for user login, the NAS
(Network Access Server) prompts for the user login credentials and requests services from the
DWS-3000 TACACS+ client. The client then uses the configured list of servers for
authentication, and provides results back to the NAS. You can configure the TACACS+ server
list with one or more hosts defined via their network IP address. You can also assign each a
priority to determine the order in which the TACACS+ client will contact them. TACACS+
contacts the server when a connection attempt fails or times out for a higher priority server.
You can configure each server host with a specific connection type, port, timeout, and shared
key, or you can use global configuration for the key and timeout.
Like RADIUS, the TACACS+ server can do the authentication itself, or redirect the request to
another back-end device. All sensitive information is encrypted and the shared secret is never
passed over the network - it is used only to encrypt the data.

TACACS+ Configuration Example

This example configures two TACACS+ servers at 10.10.10.10 and 11.11.11.11. Each server
has a unique shared secret key. The server at 10.10.10.10 has a default priority of 0, the highest
priority, while the other server has a priority of 2. A new authentication list called tacacsList is
created which uses TACACS+ to authenticate, and uses local authentication as a backup
method. This authentication list is then associated with the default login.
TACACS+ Configuration Example 133