Configuring Tacacs+; About Tacacs+; About Tacacs+ Server Default Configuration - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

Chapter 34 Configuring RADIUS and TACACS+
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Configuring TACACS+

A Cisco MDS switch uses the Terminal Access Controller Access Control System Plus (TACACS+)
protocol to communicate with remote AAA servers. You can configure multiple TACACS+ servers and
set timeout values.
This section includes the following topics:
•
•
•
•
•
•
•
•
•
•
•
•
•
•

About TACACS+

TACACS+ is a client/server protocol that uses TCP (TCP port 49) for transport requirements. All
switches in the Cisco MDS 9000 Family provide centralized authentication using the TACACS+
protocol. The TACACS+ has the following advantages over RADIUS authentication:
•
•
•

About TACACS+ Server Default Configuration

Fabric Manager allows you to set up a default configuration that can be used for any TACACS+ server
that you configure the switch to communicate with. The default configuration includes:
•
•
•
•
OL-18084-01, Cisco MDS NX-OS Release 4.x
About TACACS+, page 34-17
About TACACS+ Server Default Configuration, page 34-17
About the Default TACACS+ Server Encryption Type and Preshared Key, page 34-18
Enabling TACACS+, page 34-18
Setting the TACACS+ Server Address, page 34-18
Setting the Global Secret Key, page 34-20
Setting the Timeout Value, page 34-20
About TACACS+ Servers, page 34-21
Sending TACACS+ Test Messages for Monitoring, page 34-24
Password Aging Notification through TACACS+ Server, page 34-24
About Users Specifying a TACACS+ Server at Login, page 34-24
Allowing Users to Specify a TACACS+ Server at Login, page 34-25
Defining Custom Attributes for Roles, page 34-25
Displaying TACACS+ Server Details, page 34-26
Provides independent, modular AAA facilities. Authorization can be done without authentication.
Uses the TCP transport protocol to send data between the AAA client and server, making reliable
transfers with a connection-oriented protocol.
Encrypts the entire protocol payload between the switch and the AAA server to ensure higher data
confidentiality. The RADIUS protocol only encrypts passwords.
Encryption type
Preshared key
Timeout value
Number of retransmission attempts
Cisco MDS 9000 Family CLI Configuration Guide
Configuring TACACS+
34-17