Specifying Tacacs+ Authorization For Privileged Exec Access And Network Services; Starting Tacacs+ Accounting - Cisco Catalyst 2950 Software Manual

Configuring TACACS+
•
To create a default list that is used if no list is specified in the login authentication line configuration
command, use the default keyword followed by the methods that you want used in default situations.
The additional methods of authentication are used only if previous method returns an error, not if it fails.
To specify that the authentication should succeed even if all methods return an error, specify none as the
final method in the command line.
Specifying TACACS+ Authorization for Privileged EXEC Access and Network
Services
You can use the aaa authorization global configuration command with the tacacs+ keyword to set
parameters that restrict a user's network access to Cisco IOS privileged-mode (EXEC access) and to
network services such as Serial Line Internet Protocol (SLIP), Point-to-Point Protocol (PPP) with
Network Control Protocols (NCPs), and AppleTalk Remote Access (ARA).
The aaa authorization exec tacacs+ local command sets these authorization parameters:
•
•
Authorization is bypassed for authenticated users who login through the CLI even if authorization has
Note
been configured.
Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for
privileged EXEC access and network services:
Command
Step 1 configure terminal
Step 2
aaa authorization network tacacs+ Configure the switch for user TACACS+ authorization for all
Step 3 aaa authorization exec tacacs+
Step 4
exit
Step 5
show running-config

Starting TACACS+ Accounting

You use the aaa accounting command with the tacacs+ keyword to turn on TACACS+ accounting for
each Cisco IOS privilege level and for network services.
Catalyst 2950 Desktop Switch Software Configuration Guide
6-22
tacacs+—Uses TACACS+ authentication. You must configure the TACACS+ server before you can
use this authentication method. For more information, see the
Host" section on page 6-20.
Uses TACACS+ for privileged EXEC access authorization if authentication was done by using
TACACS+.
Uses the local database if authentication was not done by using TACACS+.
Purpose
Enter global configuration mode.
network-related service requests, including SLIP, PPP NCPs, and ARA
protocols.
Configure the switch for user TACACS+ authorization to determine if the
user is allowed privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
Return to privileged EXEC mode.
Verify your entries.
Chapter 6 Configuring the System
"Configuring the TACACS+ Server
78-11380-03