Setting The Timeout Value; Defining Custom Attributes For Roles - Cisco DS-X9530-SF1-K9 - Supervisor-1 Module - Control Processor Configuration Manual

Configuring TACACS+
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
Command
Step 2
switch(config)# tacacs-server key
7 3sdaA3daKUngd
switch(config)# no tacacs-server
key oldPword

Setting the Timeout Value

You can configure global timeout values for all TACACS+ servers.
Note If timeout values are configured for individual servers, those values override the globally configured
values.
To set the global timeout value for TACACS+ servers, follow these steps:
Command
Step 1
switch# config t
Step 2
switch(config)# tacacs-server
timeout 30
switch(config)# no tacacs-server
timeout 30

Defining Custom Attributes for Roles

Cisco MDS 9000 Family switches use the TACACS+ custom attribute for service shells to configure
roles to which a user belongs. TACACS+ attributes are specified in
name for this custom attribute is
using this attribute:
cisco-av-pair=shell:roles="network-admin vsan-admin"
You can also configure optional custom attributes to avoid conflicts with non-MDS Cisco switches using
the same AAA servers.
cisco-av-pair*shell:roles="network-admin vsan-admin"
Additional custom attribute shell:roles are also supported:
shell:roles="network-admin vsan-admin"
or
shell:roles*"network-admin vsan-admin"
Cisco MDS 9000 Family CLI Configuration Guide
28-12
Purpose
Assigns the global secret key (in encrypted format) to access
the TACACS+ server. This example specifies 7 to indicate the
encrypted format being used. If this global key and the
individual server keys are not configured, clear text messages
are sent to the TACACS+ server(s).
Deletes the configured global secret key to access the
TACACS+ server and reverts to the factory default of allowing
access to all configured servers.
Purpose
Enters configuration mode.
Configures the global timeout period for the switch to wait for
a response from all servers before it declares a timeout failure.
Deletes the configured timeout period and reverts to the
factory default of 5 seconds.
. The following example illustrates how to specify roles
cisco-av-pair
Chapter 28 Configuring RADIUS and TACACS+
format. The attribute
name=value
OL-8222-01, Cisco MDS SAN-OS Release 3.x