Method List; Tacacs+ Configuration Options; Tacacs+ Login Authentication; Tacacs+ Authorization For Privileged Exec Access And Network Services - Cisco Catalyst 2960-X Security Configuration Manual

Method List

Method List
A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts
on a user. You can use method lists to designate one or more security protocols to be used, thus ensuring a
backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize,
or to keep accounts on users; if that method does not respond, the software selects the next method in the list.
This process continues until there is successful communication with a listed method or the method list is
exhausted.
Related Topics
How to Configure TACACS+, on page 45
Prerequisites for TACACS+, on page 39

TACACS+ Configuration Options

You can configure the switch to use a single server or AAA server groups to group existing server hosts for
authentication. You can group servers to select a subset of the configured server hosts and use them for a
particular service. The server group is used with a global server-host list and contains the list of IP addresses
of the selected server hosts.
Related Topics
Identifying the TACACS+ Server Host and Setting the Authentication Key, on page 45

TACACS+ Login Authentication

A method list describes the sequence and authentication methods to be queried to authenticate a user. You
can designate one or more security protocols to be used for authentication, thus ensuring a backup system for
authentication in case the initial method fails. The software uses the first method listed to authenticate users;
if that method fails to respond, the software selects the next authentication method in the method list. This
process continues until there is successful communication with a listed authentication method or until all
defined methods are exhausted. If authentication fails at any point in this cycle—meaning that the security
server or local username database responds by denying the user access—the authentication process stops, and
no other authentication methods are attempted.
Related Topics
Configuring TACACS+ Login Authentication, on page 47
Prerequisites for TACACS+, on page 39

TACACS+ Authorization for Privileged EXEC Access and Network Services

AAA authorization limits the services available to a user. When AAA authorization is enabled, the switch
uses information retrieved from the user's profile, which is located either in the local user database or on the
security server, to configure the user's session. The user is granted access to a requested service only if the
information in the user profile allows it.
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
44
Configuring TACACS+
OL-29048-01