Default Tacacs+ Configuration; Authentication Key - Allen-Bradley Stratix 5100 User Manual

Chapter 14 Configuring RADIUS and TACACS+ Servers
434

Default TACACS+ Configuration

TACACS+ and AAA are disabled by default.
To prevent a lapse in security, you cannot configure TACACS+ through a
network management application. When enabled, TACACS+ can authenticate
administrators accessing the access point through CLI.
Identifying the TACACS+ Server Host and Setting the Authentication
Key
You can configure the access point to use a single server or AAA server groups to
group existing server hosts for authentication. You can group servers to select a
subset of the configured server hosts and use them for a particular service. The
server group is used with a global server-host list and contains the list of IP
addresses of the selected server hosts.
Beginning in privileged EXEC mode, follow these steps to identify the IP host or
host maintaining TACACS+ server and optionally set the encryption key:
1. Enter global configuration mode.
configure terminal
2. Identify the IP host or hosts maintaining a TACACS+ server.
Enter this command multiple times to create a list of preferred hosts. The
software searches for hosts in the order that you specify.
• For
hostname
• (Optional) For
The default is port 49. The range is 1...65535.
• (Optional) For
access point waits for a response from the daemon before it times out
and declares an error.
The default is 5 seconds. The range is 1...1000 seconds.
• (Optional) For
encrypting and decrypting all traffic between the access point and the
TACACS+ daemon. You must configure the same key on the
TACACS+ daemon for encryption to be successful.
tacacs-server host hostname [port integer] [timeout
integer] [key string]
3. Enable AAA.
aaa new-model
4. (Optional) Define the AAA server-group with a group name.
This command puts the access point in a server group subconfiguration
mode.
Rockwell Automation Publication 1783-UM006A-EN-P - May 2014
, specify the name or IP address of the host.
, specify a server port number.
port integer
, specify a time in seconds the
timeout integer
, specify the encryption key for
key string