Network Assistant and TACACS+

Question

The Network Assistant Guide 5.4 states the following:
You must have privilege level 15 to access Network Assistant through TACACS+ or a RADIUS server
We do not want to give certain users prvilege level 15 (read write) access.  Are there any other options when using TACACS+?

Answer 1

Paul
What would you want to do for authentication if the TACACS server is down? For telnet and console access you can use line as the backup method since it is possible to configure a line password on the console and on the vty ports. What kind of backup method do you want for HTTP? The one that makes most sense to me would be to do local authentication to cover the situation where the server is down.
To use local authentication you will need to do the following things:
- create a local user definition (perhaps several if you have extensive security requirements).
- specify a special method for aaa authentication.
- specify that http use the special method.
The configuration might look something like this:
user tech1 password tech1
aaa authentication login http_auth group tacacs+ local
ip http authentication aaa login-authentication http_auth
Or you could decide to use the enable secret (or password depending on which is configured). The config might look something like this:
aaa authentication login http_auth group tacacs+ enable
ip http authentication aaa login-authentication http_auth
If you want some other backup method let us know what it is and we will see how it could be implemented.
HTH
Rick