Reg:Configuration of TACACS+

Question

Hi,
I m Anubhav ,i have been asigned a responsibility to configure a cisco TACACS+ server for authentication and applying user level privileges ,we have two ACS servers ,one will act as Primary and the other will act as Backup.
Actually i have no clue how to do this ,I am a CCNA ,but even after going through many PDFs ,i mnot able to get how to begin the process.Could anyone help me out with some configuration exapmles as we are not using PIX etc. and all clients will interact directly with ACS.
We have more than 800 clients , do we need to configure users for each client.
Thanks.

Answer 1

Hi Anu,
User can be configured locally in ACS or in external database like AD/LDAP/RSA. You need to add all aaa-clinets (router/ASA/switch) to ACS network configuration. And on each device you need to enable aaa.
     IOS(config)# username [username] password [password]
        tacacs-server host [ip]
        tacacs-server key [key]
        aaa new-model
        aaa authentication login default group tacacs+ local
Since you are new to ACS I will suggest not to enable authorization as that can lock you out of device (Open a TAC case if this is urgent).
PIX/ASA
aaa-server authserver protocol tacacs+
key 123456
aaa-server authserver host  10.1.1.1 (Also define interface from where acs is reachable)
aaa authentication ssh console authserver LOCAL
Regards,
~JG
Do rate helpful posts!