Default Tacacs+ Server Encryption Type And Preshared Key; Tacacs+ Server Monitoring - Cisco AJ732A - MDS 9134 Fabric Switch Configuration Manual

Chapter 18 Configuring TACACS+
S e n d f e e d b a c k t o n x 5 0 0 0 - d o c f e e d b a c k @ c i s c o . c o m

Default TACACS+ Server Encryption Type and Preshared Key

You must configure the TACACS+ preshared key to authenticate the switch to the TACACS+ server. A
preshared key is a secret text string shared between the Nexus 5000 Series switch and the TACACS+
server host. The length of the key is restricted to 63 characters and can include any printable ASCII
characters (white spaces are not allowed). You can configure a global preshared secret key for all
TACACS+ server configurations on the Nexus 5000 Series switch to use.
You can override the global preshared key assignment by explicitly using the key option when
configuring an individual TACACS+ server.

TACACS+ Server Monitoring

An unresponsive TACACS+ server can delay the processing of AAA requests. A Nexus 5000 Series
switch can periodically monitor an TACACS+ server to check whether it is responding (or alive) to save
time in processing AAA requests. The Nexus 5000 Series switch marks unresponsive TACACS+ servers
as dead and does not send AAA requests to any dead TACACS+ servers. A Nexus 5000 Series switch
periodically monitors dead TACACS+ servers and brings them to the alive state once they are
responding. This process verifies that a TACACS+ server is in a working state before real AAA requests
are sent its way. Whenever an TACACS+ server changes to the dead or alive state, a Simple Network
Management Protocol (SNMP) trap is generated and the Nexus 5000 Series switch displays an error
message that a failure is taking place before it can impact performance. See
Figure 18-1
Alive
The monitoring interval for alive servers and dead servers are different and can be configured by the user.
Note
The TACACS+ server monitoring is performed by sending a test authentication request to the TACACS+
server.
OL-16597-01
Connection parameters, including the host or client IP address (IPv4 or IPv6), access list, and
•
user timeouts
TACACS+ Server States
Alive and
Application
request
Alive and
Idle timer
expired
Dead and
Process
used application
request
Test
testing
Test
testing
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
Information About TACACS+
Figure 18-1.
Response from
remote server
No
response
AAA packets
sent
Directed
AAA request
Dead timer expired
Dead
18-3