Cisco Catalyst 4500 Series Configuration Manual page 856

Configuring Per-VRF for TACACS+ Servers
.
Command or Action
Step 1
Switch> enable
Step 2
Switch# configure terminal
Step 3
Switch(config)# ip vrf vrf-name
Step 4
Switch (config-vrf)# rd route-distinguisher
Step 5
Switch (config-vrf)# exit
Step 6
Switch (config)# interface interface-name
Step 7
Switch (config-if)# ip vrf forwarding vrf-name
Step 8
Switch (config-if)# ip address ip-address mask
[secondary]
Step 9
Switch (config-if)# exit
Step 10
aaa group server tacacs+ group-name
Example:
Switch (config)# aaa group server tacacs+
tacacs1
Step 11
server-private {ip-address | name} [nat]
[single-connection] [port port-number]
[timeout seconds] [key [0 | 7] string]
Example:
Switch (config-sg-tacacs+)# server-private
10.1.1.1 port 19 key cisco
Step 12
Switch (config-sg-tacacs+)# ip vrf forwarding
vrf-name
Step 13
Switch (config-sg-tacacs+)# ip tacacs
source-interface subinterface-name
Step 14
Switch (config-sg-tacacs)# exit
The following example lists all the steps to configure per-VRF TACACS+:
Switch> enable
Switch# configure terminal
Switch (config)# ip vrf cisco
Switch (config-vrf)# rd 100:1
Switch (config-vrf)# exit
Switch (config)# interface Loopback0
Switch (config-if)# ip vrf forwarding cisco
Switch (config-if)# ip address 10.0.0.2 255.0.0.0
Switch (config-if)# exit
Switch (config-sg-tacacs+)# ip vrf forwarding cisco
Switch (config-sg-tacacs+)# ip tacacs source-interface Loopback0
Switch (config-sg-tacacs)# exit
For more information about configuring per-VRF for TACACS+ server, see the
Cisco IOS Per VRF for TACACS + Server, Release 12.3(7)T.
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
39-10
Purpose
Enables privileged EXEC mode.
Enter your password if prompted.
Enters global configuration mode.
Configures a VRF table and enters VRF configuration mode.
Creates routing and forwarding tables for a VRF instance.
Exits VRF configuration mode.
Configures an interface and enters interface configuration
mode.
Configures a VRF for the interface.
Sets a primary or secondary IP address for an interface.
Exits interface configuration mode.
Groups different TACACS+ server hosts into distinct lists
and distinct methods and enters server-group configuration
mode.
Configures the IP address of the private TACACS+ server
for the group server.
Configures the VRF reference of a AAA TACACS+ server
group.
Uses the IP address of a specified interface for all outgoing
TACACS+ packets.
Exits server-group configuration mode.
Chapter 39 Configuring VRF-lite
OL-25340-01