N8406-023 1Gb Intelligent L3 Switch Command Reference Guide (ISCLI) 88
server configuration
(Terminal Access Controller Access Control System) is an authentication protocol that allows a remote
access server to forward a user's logon password to an authentication server to determine whether access can be
allowed to a given system. and Remote Authentication Dial-In User Service (RADIUS) protocols are
more secure than the TACACS encryption protocol. is described in RFC 1492.
protocol is more reliable than RADIUS, as uses the Transmission Control Protocol (TCP)
whereas RADIUS uses the User Datagram Protocol (UDP). Also, RADIUS combines authentication and
authorization in a user profile, whereas separates the two operations.
offers the following advantages over RADIUS as the authentication device:
is TCP-based, so it facilitates connection-oriented traffic.
It supports full-packet encryption, as opposed to password-only in authentication requests.
It supports decoupled authentication, authorization, and accounting.
The following table describes the Server Configuration commands.
Table 81 Server Configuration commands
Command
Description
[no] tacacs-server primary-host
<
IP
address
>
key
<
1-32 characters
>
Defines the primary server address.
Command mode
: Global configuration
[no] tacacs-server secondary-host
<
IP address
>
key
<
1-32 characters
>
Defines the primary or secondary shared secret between the
switch and the server(s).
Command mode
: Global configuration
tacacs-server port
<
TCP port number
>
Enter the number of the TCP port to be configured, between 1 -
65000. The default is 49.
Command mode
: Global configuration
tacacs-server retransmit
<
1-3
>
Sets the number of failed authentication requests before
switching to a different server. The range is 1-3
requests. The default is 3 requests.
Command mode
: Global configuration
tacacs-server timeout
<
4-15
>
Sets the amount of time, in seconds, before a server
authentication attempt is considered to have failed. The range
is 4-15 seconds. The default is 5 seconds.
Command mode
: Global configuration
[no] tacacs-server telnet-backdoor
Enables or disables the back door for telnet. The
telnet
command also applies to
SSH/SCP connections and
the Browser-based Interface (BBI). The default is disabled. This
command does not apply when secure backdoor (
secbd
) is
enabled.
Command mode
: Global configuration
[no] tacacs-server secure-backdoor
Enables or disables the back door using secure
password for telnet/SSH/ HTTP/HTTPS. The default is
disabled. This command does not apply when backdoor
(
telnet
) is
enabled
.
Command mode
: Global configuration
[no] tacacs-server privilege-mapping
Enables or disables privilege-level mapping.
The default value is
disabled
.
Command mode
: Global configuration
[no] tacacs-server user-mapping <
0-
15
> {user|oper|admin}
Maps a authorization level to this switch user level.
Enter a privilege level (0-15), followed by the
corresponding the user level (user, oper, admin).
Command mode
: Global configuration
tacacs-server enable
Enables the server.
Command mode:
Global configuration
no tacacs-server enable
Disables the server. This is the default.
Command mode:
Global configuration
show tacacs-server
Displays current configuration parameters.
Command mode
: All except User EXEC
