Configuring Tacacs+ Support; Configuring Authentication; Configuring Accounting - Juniper JUNOSE SOFTWARE 11.2.X - BROADBAND ACCESS CONFIGURATION GUIDE 7-20-2010 Configuration Manual

JunosE 11.2.x Broadband Access Configuration Guide

Configuring TACACS+ Support

Configuring Authentication

Configuring Accounting

316
To use TACACS+, you must enable AAA. To configure your router to support TACACS+,
perform the following tasks. Some of the tasks are optional. Once you configure TACACS+
support on the router, you can configure TACACS+ authentication, authorization, and
accounting independent of each other.
Specify the names of the IP host or hosts maintaining a TACACS+ server. Optionally,
1.
you can specify other parameters, such as port number, timeout interval, and key.
host1(config)#tacacs-server host 192.168.1.27 port 10 timeout 3 key your_secret
primary
(Optional) Set the authentication and encryption key value shared by all TACACS+
2.
servers that do not have a server-specific key set up by the tacacs-server host
command.
host1(config)#tacacs-server key " &#889P^"
(Optional) Set alternative source address(es) to be used for TACACS+ server
3.
communications.
host1(config)#tacacs-server source-address 192.168.134.63
(Optional) Set the timeout value for all TACACS+ servers that do not have a
4.
server-specific timeout set up by the tacacs-server host command.
host1(config)#tacacs-server timeout 15
Once TACACS+ support is enabled on the router, you can configure TACACS+
authentication. Perform the following steps:
Specify AAA new model as the authentication method for the vty lines on your router.
1.
host1(config)#aaa new-model
Specify AAA authentication by defining an authorization methods list.
2.
host1(config)#aaa authentication login tac tacacs+ radius enable
Specify the privilege level by defining a methods list that uses TACACS+ for
3.
authentication.
host1(config)#aaa authentication enable default tacacs+ radius enable
Configure vty lines.
4.
host1(config)#line vty 0 4
Apply an authentication list to the vty lines you specified on your router.
5.
host1(config-line)#login authentication tac
Once TACACS+ support is enabled on the router, you can configure TACACS+ accounting.
Perform the following steps:
Copyright © 2010, Juniper Networks, Inc.