1. Tacacs With CISCO Device Authentication
1.1. Static IP
1.2 Install Tacac On Ubuntu Server 14.04
1.3 Generate a password for Enable
1.4 Configire Tacacs
1.5 Create users in Linux System And Set Password For Users
2. Configure On Router (c3600)
2.1 Set IP Address And Add Tacacs Server
2.2 Test Login
Tacac Server IP:
123.123.123.55
Router IP:
123.123.123.56
123.123.123.55
123.123.123.56
tacacs-svr (eth0)---------------------------------------------------(interface fa0/0) Router1
1. Tacacs With CISCO Device Authentication
1.1. Static IP
vi /etc/network/interfaces
auto eth0
iface eth0 inet static
address 123.123.123.55
netmask 255.255.255.0
gateway 123.123.123.2
dns-nameservers 123.123.123.2
dns-nameservers 8.8.8.8
vi /etc/hostname
tacacs-svr
vi /etc/hosts
127.0.1.1 tacacs-svr
123.123.123.55 tacacs-svr
vi /etc/resolv.conf
nameserver 123.123.123.2
search localdomain
1.2 Install Tacac On Ubuntu Server 14.04
Installations
apt-get install tacacs+
1.3 Generate a password for Enable
root@tacacs-svr:~# tac_pwd
Password to be encrypted:
vannak123
ir0SF/mM8ddFI
root@tacacs-svr:~#
1.4 Configire Tacacs
cp /etc/tacacs+/tac_plus.conf /etc/tacacs+/tac_plus.conf.original
touch /var/log/tac_plus.acct
vim /etc/tacacs+/tac_plus.conf
With content:
#################### CONFIG #######################
key = tacacs123
accounting syslog;
accounting file = /var/log/tac_plus.acct
###################### ACL ########################
acl = network_admin {
# allow access from all sources
permit = .*
}
acl = support-team {
# allow access to 123.123.123.56 only
permit = 123\.123\.123\.56$
}
#################### GROUP ########################
group = network_admin {
default service = permit
acl = network_admin
service = exec {
priv-lvl = 15
}
}
group = support-team {
default service = deny
acl = router-hq
service = exec {
priv-lvl = 0
}
cmd = enable {
permit .*
}
cmd = show {
permit .*
}
cmd = exit {
permit .*
}
}
#################### USER ########################
user = tacacadmin {
login = file /etc/passwd
member = network_admin
}
user = tacacuser1 {
login = file /etc/passwd
member = support-team
}
#################### ENABLE ########################
user = $enab15$ {
login = des
ir0SF/mM8ddFI
}
1.5 Create users in Linux System And Set Password For Users
useradd -m tacacadmin
passwd tacacadmin
useradd -m tacacuser1
passwd tacacuser1
2. Configure On Router (c3600)
2.1 Set IP Address And Add Tacacs Server
Router>en
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R1
R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 123.123.123.56 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#end
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#aaa new-model
R1(config)#aaa authentication login default group tacacs+ enable
R1(config)#aaa authentication enable default group tacacs+ enable
R1(config)#aaa authentication commands 15 default group tacacs+ if-authenticated
R1(config)#tacacs-server host 123.123.123.55
R1(config)#tacacs-server key tacacs123
R1(config)#end
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#enable secret vannakenable
R1(config)#end
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#line console 0
R1(config-line)#password vannak0
R1(config-line)#end
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#line vty 0 15
R1(config-line)#password vannak015
R1(config-line)#end
R1#write
Building configuration...
[OK]
R1#
2.2 Test Login
Login with tacacadmin
Login with tacacuser1
