Tacacs With CISCO Device Authentication

1. Tacacs With CISCO Device Authentication
1.1. Static IP
1.2 Install Tacac On Ubuntu Server 14.04
1.3 Generate a password for Enable
1.4 Configire Tacacs
1.5 Create users in Linux System And Set Password For Users

2. Configure On Router (c3600)
2.1 Set IP Address And Add Tacacs Server
2.2 Test Login

Tacac Server IP: 123.123.123.55
Router IP: 123.123.123.56

123.123.123.55                                                        123.123.123.56
tacacs-svr (eth0)---------------------------------------------------(interface fa0/0) Router1


1. Tacacs With CISCO Device Authentication
1.1. Static IP

vi /etc/network/interfaces
auto eth0
iface eth0 inet static
address 123.123.123.55
netmask 255.255.255.0
gateway 123.123.123.2
dns-nameservers 123.123.123.2
dns-nameservers 8.8.8.8

vi /etc/hostname
tacacs-svr

vi /etc/hosts
127.0.1.1       tacacs-svr
123.123.123.55  tacacs-svr

vi /etc/resolv.conf
nameserver 123.123.123.2
search localdomain

1.2 Install Tacac On Ubuntu Server 14.04
Installations
apt-get install tacacs+

1.3 Generate a password for Enable

root@tacacs-svr:~# tac_pwd
Password to be encrypted: vannak123
ir0SF/mM8ddFI
root@tacacs-svr:~#

1.4 Configire Tacacs
cp /etc/tacacs+/tac_plus.conf /etc/tacacs+/tac_plus.conf.original
touch /var/log/tac_plus.acct

vim /etc/tacacs+/tac_plus.conf
With content:
#################### CONFIG #######################
key = tacacs123
accounting syslog;
accounting file = /var/log/tac_plus.acct
###################### ACL ########################
acl = network_admin {
        # allow access from all sources
        permit = .*
}
acl = support-team {
        # allow access to 123.123.123.56 only
        permit = 123\.123\.123\.56$
        }
#################### GROUP ########################
group = network_admin {
        default service = permit
        acl = network_admin
        service = exec {
        priv-lvl = 15
                }
        }
group = support-team {
        default service = deny
        acl = router-hq
        service = exec {
        priv-lvl = 0
        }
        cmd = enable {
                permit .*
        }
        cmd = show {
                permit .*
        }
        cmd = exit {
                permit .*
        }
}
#################### USER ########################
user = tacacadmin {
        login = file /etc/passwd
        member = network_admin
}
user = tacacuser1 {
        login = file /etc/passwd
        member = support-team
}
#################### ENABLE ########################
user = $enab15$ {
        login = des ir0SF/mM8ddFI
}

1.5 Create users in Linux System And Set Password For Users
useradd -m tacacadmin
passwd tacacadmin

useradd -m tacacuser1
passwd tacacuser1

2. Configure On Router (c3600)
2.1 Set IP Address And Add Tacacs Server 
Router>en
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R1
R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 123.123.123.56 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#end
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#aaa new-model
R1(config)#aaa authentication login default group tacacs+ enable
R1(config)#aaa authentication enable default group tacacs+ enable
R1(config)#aaa authentication commands 15 default group tacacs+ if-authenticated
R1(config)#tacacs-server host 123.123.123.55
R1(config)#tacacs-server key tacacs123
R1(config)#end
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#enable secret vannakenable
R1(config)#end
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#line console 0
R1(config-line)#password vannak0
R1(config-line)#end
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#line vty 0 15
R1(config-line)#password vannak015
R1(config-line)#end
R1#write
Building configuration...
[OK]
R1#

2.2 Test Login

Login with tacacadmin

Login with tacacuser1