Filter
Top Products
177
Enhancements in Release F.02.02
TACACS+ Authentication for Centralized Control of Switch Access Security
Configuring the Switch’s TACACS+ Server Access
The tacacs-server command configures these parameters:
■ The host IP address(es) for up to three TACACS+ servers; one first-choice and up to two
backups. Designating backup servers provides for a continuation of authentication services
in case the switch is unable to contact the first-choice server.
■ An optional encryption key. This key helps to improve security, and must match the
encryption key used in your TACACS+ server application. In some applications, the term
"secret key" or "secret" may be used instead of "encryption key". If you need only one
encryption key for the switch to use in all attempts to authenticate through a TACACS+
server, configure a global key. However, if the switch is configured to access multiple
TACACS+ servers having different encryption keys, you can configure the switch to use
different encryption keys for different TACACS+ servers.
■ The timeout value in seconds for attempts to contact a TACACS+ server. If the switch sends
an authentication request, but does not receive a response within the period specified by the
timeout value, the switch resends the request to the next server in its Server IP Addr list, if
any. If the switch still fails to receive a response from any TACACS+ server, it reverts to
whatever secondary authentication method was configured using the
aaa authentication
command (local or none; see “Configuring the Switch’s Authentication Methods” on page
174.)
Syntax: tacacs-server host <ip-addr> [key < key-string >] Adds a TACACS+ server and optionally
assigns a server-specific encryption key.
[no] tacacs-server host <ip-addr> Removes a TACACS+ server assignment
(including its encryption key, if any).
tacacs-server key <key-string> Enters the optional global encryption key.
[no] tacacs-server key Removes the optional global encryption
key. (Does not affect any server-specific
encryption key assignments.)
tacacs-server timeout < 1 . . 255 > Changes the wait period for a TACACS
server response. (Default: 5 seconds.)