Cisco IOS XR Configuration Manual page 234

Configuration Examples for Configuring AAA Services
secret lab
group root-system
exit
username user2
secret lab
exit
A task group named tga is created, tasks are added to tga, a user group named uga is created, and uga is
configured to inherit permissions from task group tga. A description is added to task group uga.
taskgroup tga
task read bgp
task write ospf
exit
usergroup uga
taskgroup tga
description usergroup uga
exit
Username user2 is configured to inherit from user group uga.
username user2
group uga
exit
Three TACACS servers are configured.
tacacs-server host 1.1.1.1 port 1 key abc
tacacs-server host 2.2.2.2 port 2 key def
tacacs-server host 3.3.3.3 port 3 key ghi
A user group named priv5 is created, which will be used for users authenticated using the TACACS+
method and whose entry in the external TACACS+ daemon configuration file has a privilege level of 5.
usergroup priv5
taskgroup operator
exit
An authorization method list, vty-author, is configured. This example specifies that command
authorization be done using the list of all configured TACACS+ servers.
aaa authorization commands vty-author group tacacs+
An accounting method list, vty-acct, is configured. This example specifies that start-stop command
accounting be done using the list of all configured TACACS+ servers.
aaa accounting commands vty-acct start-stop group tacacs+
For TACACS+ authentication, if, for example, a privilege level 8 is returned, and no local usergroup
priv8 exists and no local user with the same name exists, the aaa default-taskgroup command with tga
specified as the taskgroup-name argument ensures that such users are given the taskmap of the task group
tga.
aaa default-taskgroup tga
For line template vty, a line password is assigned that is used with line authentication and makes
usergroup uga the group that is assigned for line authentication (if used), and makes vty-authen,
vty-author, and vty-acct, respectively, the method lists that are used for authentication, authorization,
and accounting.
line template vty
password lab
Cisco IOS XR System Security Configuration Guide
SC-222
Configuring AAA Services on Cisco IOS XR Software