Cisco Catalyst 4500 Series Configuration Manual page 148

Controlling Access to Privileged EXEC Commands
Figure 3-4
UNIX workstation
(TACACS+
server 1)
171.20.10.7
UNIX workstation
(TACACS+
server 2)
171.20.10.8
TACACS+ administered through the AAA security services can provide these services:
• Authentication—Provides complete control of authentication through login and password dialog,
challenge and response, and messaging support.
The authentication facility can conduct a dialog with the user (such as, after a username and
password are provided, to challenge a user with several questions such as home address, mother's
maiden name, service type, and social security number). The TACACS+ authentication service can
also send messages to user screens. For example, a message could notify users that their passwords
must be changed because of the company's password aging policy.
• Authorization—Provides strict control over user capabilities for the duration of the user's session,
including but not limited to setting autocommands, access control, session duration, or protocol
support. You can also enforce restrictions on the commands a user can execute with the TACACS+
authorization feature.
Accounting—Collects and sends information used for billing, auditing, and reporting to the
•
TACACS+ daemon. Network managers can use the accounting facility to track user activity for a
security audit or to provide information for user billing. Accounting records include user identities,
start and stop times, executed commands (such as PPP), number of packets, and number of bytes.
The TACACS+ protocol provides authentication between the switch and the TACACS+ daemon, and it
ensures confidentiality because all protocol exchanges between the switch and the TACACS+ daemon
are encrypted.
You need a system running the TACACS+ daemon software to use TACACS+ on your switch.
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
3-16
Typical TACACS+ Network Configuration
Catalyst 6500
series switch
Configure the switches with the
TACACS+ server addresses.
Set an authentication key
(also configure the same key on
the TACACS+ servers).
Enable AAA.
Create a login authentication method list.
Apply the list to the terminal lines.
Create an authorization and accounting
Workstations
method list as required.
Chapter 3 Configuring the Switch for the First Time
Workstations
OL-25340-01