Chapter 29: Security
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
847
Caution: Those operators and MSOs who are using Linux or freeware TACACS servers should configure their servers for
multi-connection mode; otherwise, some users who are entitled to authorization may be denied. Those operators and
MSOs who are not using Linux or freeware TACACS servers may prefer to set those servers to single-connection mode in
order to avoid running out of available ports during heavy command usage.
Consider the following examples:
configure tacacs host 10.9.8.7 key hostTacKey
configure tacacs host 10.9.8.6 key hostTacKey
configure tacacs host 10.9.8.5 key hostTacKey timeout 4
configure tacacs group group1 host 10.9.8.7
configure tacacs group group1 host 10.9.8.6
This sequence defines three servers, 10.9.8.7, 10.9.8.6, and 10.9.8.5, all of which use the same shared secret
(hostTacKey). Servers 10.9.8.7 and 10.9.8.6 use the default timeout value of 0 which implies no timeout, while server
10.9.8.5 uses the timeout value of 4. All servers are members of the default server group, while servers 10.9.8.7
and 10.9.8.6 are assigned to server group group1.
Use the following command to display all configured server groups, their members, and the operational
parameters of each member. If the detail
keyword is added, then utilization and performance measurements are also
displayed for each Server.
show tacacs [detail]
Keywords specifying authentication methods may appear in any order, and they may be repeated. The order of keywords
specifying authentication methods is significant in that method n+1 is employed if method n is unavailable.
configure authentication listName [line] [enable] [local] [tacacs {groupName | default}] [none] [no]
The following commands are valid examples:
configure authentication list1 tacacs tac_default local
configure authentication list2 tacacs group2 line
Note: The none parameter should not be used when configuring authentication lists due to the resulting lack of security.
They define two authentication method lists: list1 and list2. The first list specifies two authentication methods: the default
server group and the local user/password file. The second list specifies three authentication methods:
server group group2, the line password, and finally no authentication.
configure authorization listName [local] [tacacs {groupName | default}] [none] [no]
