Table of Contents
Advertisement
Configuring TACACS+
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
Configuring TACACS+
A Cisco MDS switch uses the Terminal Access Controller Access Control System Plus (TACACS+)
protocol to communicate with remote AAA servers. You can configure multiple TACACS+ servers and
set timeout values.
About TACACS+
TACACS+ is a client/server protocol that uses TCP (TCP port 49) for transport requirements. All
switches in the Cisco MDS 9000 Family provide centralized authentication using the TACACS+
protocol. The addition of TACACS+ support in Cisco SAN-OS 1.3 enables the following advantages
over RADIUS authentication:
•
•
•
Enabling TACACS+
By default, the TACACS+ feature is disabled in all switches in the Cisco MDS 9000 Family. You must
explicitly enable the TACACS+ feature to access the configuration and verification commands for fabric
authentication. When you disable this feature, all related configurations are automatically discarded.
To enable TACACS+ for a Cisco MDS switch, follow these steps:
Command
Step 1
switch# config t
Step 2
switch(config)# tacacs+ enable
switch(config)# no tacacs+ enable
Setting the TACACS+ Server Address
If a secret key is not configured for a configured server, a warning message is issued if a global key is
not configured. If a server key is not configured, the global key (if configured) is used for that server (see
the
Prior to Cisco MDS SAN-OS Release 2.1(2), you can use the dollar sign ($) in the key but the key must
Note
be enclosed in double quotes, for example "k$". The percent sign (%) is not allowed. In Cisco MDS
SAN-OS Release 2.1(2) and later, you can use the dollar sign ($) (without double quotes) and the percent
sign (%) in global secret keys.
Cisco MDS 9000 Family CLI Configuration Guide
28-10
Provides independent, modular AAA facilities. Authorization can be done without authentication.
TCP transport protocol to send data between the AAA client and server, using reliable transfers with
a connection-oriented protocol.
Encrypts the entire protocol payload between the switch and the AAA server to ensure higher data
confidentiality. The RADIUS protocol only encrypts passwords.
"Setting the Global Secret Key" section on page
Chapter 28
Purpose
Enters configuration mode.
Enables the TACACS+ in this switch.
Disables (default) the TACACS+ in this switch.
28-11).
Configuring RADIUS and TACACS+
OL-8222-01, Cisco MDS SAN-OS Release 3.x
Advertisement
Table of Contents
