The following sequence of events take place when you attempt to log in to a TACACS+ server using the Password Authentication Protocol (PAP):

1. When a connection is established, the TACACS+ daemon is contacted to obtain the username and password.

   Note

   TACACS+ allows an arbitrary conversation between the daemon and the user until the daemon receives enough information to authenticate the user. This action is usually done by prompting for a username and password combination, but might include prompts for additional information, such as your mother’s maiden name.

2. The TACACS+ daemon provides one of the following responses:
   1. ACCEPT—User authentication succeeds and service begins. If user authorization is needed, authorization begins.
   2. REJECT—User authentication failed. The TACACS+ daemon either denies further access to the user or prompts the user to retry the login sequence.
   3. ERROR—An error occurred at some time during authentication either at the daemon or in the network connection. If an ERROR response is received, the device tries to use an alternative method for authenticating the user.
   If further authorization is required after authentication, the user also undergoes an additional authorization phase. Users must first successfully complete TACACS+ authentication before proceeding to TACACS+ authorization.
3. If TACACS+ authorization is required, the TACACS+ daemon is contacted and it returns an ACCEPT or REJECT authorization response. An ACCEPT response contains attributes that are used to direct the EXEC or NETWORK session for that user and determines the services that the user can access. Services include the following:
   • Telnet, rlogin, Point-to-Point Protocol (PPP), Serial Line Internet Protocol (SLIP), or EXEC services
   • Connection parameters, including the host or client IP address, access list, and user timeouts

You must configure the TACACS+ preshared key to authenticate to the TACACS+ server. A preshared key is a secret text string shared between the device and the TACACS+ server host. The length of the key is restricted to 63 characters and can include any printable ASCII characters (white spaces are not allowed). You can configure a global preshared secret key for all TACACS+ server configurations.

You can override the global preshared key assignment by explicitly using the key option when configuring an individual TACACS+ server.

Unresponsive TACACS+ servers are marked as dead and are not sent AAA requests. Dead TACACS+ servers are periodically monitored and brought back alive once they respond. This process confirms that a TACACS+ server is in a working state before real AAA requests are sent its way. The following figure shows how a TACACS+ server state change generates a Simple Network Management Protocol (SNMP) trap and an error message showing the failure before it impacts performance.

Figure 1. TACACS+ Server States

Note	The monitoring interval for alive servers and dead servers are different and can be configured by the user. The TACACS+ server monitoring is performed by sending a test authentication request to the TACACS+ server.

The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific attributes (VSAs) between the network access server and the TACACS+ server. The IETF uses attribute 26. VSAs allow vendors to support their own extended attributes that are not suitable for general use.

By default, TACACS+ is disabled. You must explicitly enable the TACACS+ feature to access the configuration and verification commands that support TACACS+ authentication.

Caution

When you disable TACACS+, all related configurations are automatically discarded.

1.    switch# configure terminal

2.    switch(config)# [no] tacacs+ enable

3.    switch(config)# exit

4.    switch(config)# copy running-config startup-config

switch# configure terminal
switch(config)# tacacs+ enable
switch(config)# exit
switch# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# tacacs-server key [ 0 | 7 ] global_key

3.    switch(config)# tacacs-server host { ipv4-address | host-name} key [0 | 7] shared_key

4.    switch(config)# exit

5.    (Optional) switch# show tacacs-server

6.    (Optional) switch(config)# copy running-config startup-config

switch# configure terminal
switch(config)# tacacs-server key 0 QsEFtkI#
switch(config)# exit
switch# show tacacs-server
Global TACACS+ shared secret:********
timeout value:5
deadtime value:0
total number of servers:1

following TACACS+ servers are configured:
        10.10.2.2:
                available on port:49
switch# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# tacacs-server host {ipv4-address | host-name}

3.    switch(config)# exit

4.    (Optional) switch(config)# show tacacs-server

5.    (Optional) switch(confgi)# copy running-config startup-config

switch# configure terminal
switch(config)# tacacs-server host 10.10.2.2
switch(config)# exit
switch# show tacacs-server 
timeout value:5
deadtime value:0
total number of servers:1

following TACACS+ servers are configured:
        10.10.2.2:
                available on port:49
switch# copy running-config startup-config

1.    switch# configure terminalt

2.    switch(config)# aaa group server tacacs+ group-name

3.    switch(config-tacacs+)# server { ipv4-address | host-name}

4.    (Optional) switch(config-tacacs+)# deadtime minutes

5.    (Optional) switch(config-tacacs+)# use-vrf vrf-name

6.    (Optional) switch(config-tacacs+)# source-interface {interface-type} {interface-number}

7.    (Optional) switch(config-tacacs+)# show tacacs-server groups

8.    (Optional) switch(config-tacacs+)# copy running-config startup-config

switch# config terminal
switch(config)# aaa group server tacacs+ TacServer
switch(config-tacacs+)# server 10.10.2.2
switch(config-tacacs+)# deadtime 30
switch(config-tacacs+)# use-vrf management
switch(config-tacacs+)# source-interface mgmt0
switch(config-tacacs+)# show tacacs-server groups 
total number of groups:1

following TACACS+ server groups are configured:
        group TacServer:
                server 10.10.2.2 on port 49
                deadtime is 30
                vrf is management
switch# copy running-config startup-config

This procedure allows you to designate the TACACS+ server to send their authentication request to. This is called a directed-request.

When directed requests are enabled, the user can log in as username@vrfname:hostname, where vrfname is the VRF to use and hostname is the name of a configured TACACS+ server.

Note	User-specified logins are only supported for Telnet sessions.

1.    switch# configure terminal

2.    switch(config)# tacacs-server directed-request

3.    switch(config)# exit

4.    (Optional) switch(config)# show tacacs-server directed-request

5.    switch(config)# copy running-config startup-config

switch# config terminal
switch(config)# tacacs-server directed-request
switch(config)# exit
switch# show tacacs-server directed-request
enabled
switch# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# tacacs-server timeout seconds

3.    switch(confi)# exit

4.    (Optional) switch(config)# show tacacs-server

5.    (Optional) switch(confi)# copy running-config startup-config

switch# configure terminal
switch(config)# tacacs-server timeout 10 
switch(config)# exit 
switch# n1000v# show tacacs-server
Global TACACS+ shared secret:********
timeout value:10
deadtime value:0
total number of servers:1

following TACACS+ servers are configured:
        10.10.2.2:
                available on port:49
switch# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# tacacs-server host {ipv4-address | host-name} timeout seconds

3.    switch(config)# exit

4.    (Optional) switch(config)# show tacacs-server

5.    (Optional) switch(config)# copy running-config startup-config

switch# config terminal
switch(config)#  tacacs-server host 10.10.2.2 timeout 10 
switch(config)# exit
switch# n1000v# show tacacs-server
Global TACACS+ shared secret:********
timeout value:10
deadtime value:0
total number of servers:1

following TACACS+ servers are configured:
        10.10.2.2:
                available on port:49
                timeout:10
switch# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# tacacs-server host {ipv4-address | host-name} port tcp-port

3.    switch(config)# exit

4.    (Optional) switch(config)# show tacacs-server

5.    (Optional) switch(config)# copy running-config startup-config

switch# configure terminal
switch(config)# tacacs-server host 10.10.2.2 port 2
switch(config)# exit
switch# show tacacs-server
Global TACACS+ shared secret:********
timeout value:10
deadtime value:0
total number of servers:1

following TACACS+ servers are configured:
        10.10.2.2:
                available on port:2
                timeout:10
switch# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# tacacs-server host { ipv4-address | host-name } test { idle-time minutes | password password [ idle-time minutes] | username name [ password password [ idle-time minutes] ] }

3.    switch(config)# tacacs-server dead-time minutes

4.    switch(config)# exit

5.    (Optional) switch(config)# show tacacs-server

6.    (Optional) switch(config)# copy running-config startup-config

switch# configure terminal
switch(config)# tacacs-server host 10.10.2.2 test username pvk2 password a3z9yjqz7 idle-time 3
switch(config)# tacacs-server dead-time 5
switch(config)# exit
switch# show tacacs-server 
Global TACACS+ shared secret:********
timeout value:10
deadtime value:5
total number of servers:1

following TACACS+ servers are configured:
        10.10.2.2:
                available on port:2
                timeout:10
switch# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# tacacs-server deadtime minutes

3.    switch(config)# exit

4.    (Optional) switch(config)# show tacacs-server

5.    (Optional) switch(config)# copy running-config startup-config

switch# configure terminal
switch(config)#  tacacs-server deadtime 5 
switch(config)# exit
switch# show tacacs-server 
Global TACACS+ shared secret:********
timeout value:10
deadtime value:5
total number of servers:1

following TACACS+ servers are configured:
        10.10.2.2:
                available on port:2
                timeout:10
switch# copy running-config startup-config