Cisco MDS 9000 Series Configuration Manual page 86

About TACACS+
This section includes the following topics:
About TACACS+
TACACS+ is a client/server protocol that uses TCP (TCP port 49) for transport requirements. All switches
in the Cisco MDS 9000 Family provide centralized authentication using the TACACS+ protocol. The
TACACS+ has the following advantages over RADIUS authentication:
• Provides independent, modular AAA facilities. Authorization can be done without authentication.
• Uses the TCP transport protocol to send data between the AAA client and server, making reliable transfers
• Encrypts the entire protocol payload between the switch and the AAA server to ensure higher data
About TACACS+ Server Default Configuration
Fabric Manager allows you to set up a default configuration that can be used for any TACACS+ server that
you configure the switch to communicate with. The default configuration includes:
• Encryption type
• Preshared key
• Timeout value
• Number of retransmission attempts
• Allowing the user to specify a TACACS+ server at login
About the Default TACACS+ Server Encryption Type and Preshared Key
You need to configure the TACACS+ preshared key to authenticate the switch to the TACACS+ server. The
length of the key is restricted to 64 characters and can include any printable ASCII characters (white spaces
are not allowed). You can configure a global key to be used for all TACACS+ server configurations on the
switch.
You can override this global key assignment by explicitly using the key option when configuring and individual
TACACS+ server.
Enabling TACACS+
By default, the TACACS+ feature is disabled in all switches in the Cisco MDS 9000 Family. You must
explicitly enable the TACACS+ feature to access the configuration and verification commands for fabric
authentication. When you disable this feature, all related configurations are automatically discarded.
To enable TACACS+ for a Cisco MDS switch, follow these steps:
Procedure
Step 1
switch# configure terminal
Enters configuration mode.
Step 2 switch(config)# feature tacacs+
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
68
with a connection-oriented protocol.
confidentiality. The RADIUS protocol only encrypts passwords.
Configuring Security Features on an External AAA Server