About Custom Attributes For Roles; Supported Tacacs+ Servers; Server Groups - Cisco AP775A - Nexus Converged Network Switch 5010 Configuration Manual

Chapter 41 Configuring RADIUS and TACACS+
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

About Custom Attributes for Roles

Cisco MDS 9000 Family switches use the TACACS+ custom attribute for service shells to configure
roles to which a user belongs. TACACS+ attributes are specified in name=value format. The attribute
name for this custom attribute is cisco-av-pair. The following example illustrates how to specify roles
using this attribute:
cisco-av-pair=shell:roles="network-admin vsan-admin"
You can also configure optional custom attributes to avoid conflicts with non-MDS Cisco switches using
the same AAA servers.
cisco-av-pair*shell:roles="network-admin vsan-admin"
Additional custom attribute shell:roles are also supported:
shell:roles="network-admin vsan-admin"
or
shell:roles*"network-admin vsan-admin"
TACACS+ custom attributes can be defined on an Access Control Server (ACS) for various services (for
Note
example, shell). Cisco MDS 9000 Family switches require the TACACS+ custom attribute for the service
shell to be used for defining roles.

Supported TACACS+ Servers

The Cisco NX-OS software currently supports the following parameters for the listed TACACS+ servers:
•
•
•

Server Groups

You can specify one or more remote AAA servers to authenticate users using server groups. All members
of a group must belong to the same protocol, either RADIUS or TACACS+. The servers are tried in the
same order in which you configure them.
The AAA server monitoring feature can mark an AAA server as dead. You can configure a period of time
in minutes to elapse before the switch sends requests to a dead AAA server. (See the
Monitoring" section on page
OL-17256-03, Cisco MDS NX-OS Release 4.x
TACACS+
cisco-av-pair=shell:roles="network-admin"
Cisco ACS TACACS+
shell:roles="network-admin"
shell:roles*"network-admin"
cisco-av-pair*shell:roles="network-admin"
cisco-av-pair*shell:roles*"network-admin"
cisco-av-pair=shell:roles*"network-admin"
Open TACACS+
cisco-av-pair*shell:roles="network-admin"
cisco-av-pair=shell:roles*"network-admin"
41-5.)
Cisco MDS 9000 Family Fabric Manager Configuration Guide
Server Groups
"AAA Server
41-19