Specifications

How Do I Implement TACACS+?
December 2, 2010 Page 2 of 7
How Do I Implement TACACS+?
YoucanconfiguretheTACACS+clientonyourEnterasysdeviceinconjunctionwithoneormore
(uptoeight)TACACS+accessserverstoprovideauthentication,authorization,oraccounting
servicesonyournetwork.EachoftheTACACS+servicescanbeimplementedonseparateservers.
YoucanalsoconfigureTACACS+tousea
singleTCPconnectionforallTACACS+clientrequests
toagivenTACACS+server.
FormoreinformationaboutthebasicTACACS+configuration,see“BasicTACACS+
Configuration”onpage 4.
Understanding TACACS+
TACACS+clientfunctionalityfallsintofourbasiccapabilities:
• Authenticationandsessionauthorization
• Commandauthorization
•Sessionaccounting
• Commandaccounting
Session Authorization and Accounting
TheTACACS+clientisdisabledbydefault.WhentheTA CACS+clientisenabledonanEnterasys
deviceandasessionisinitiated,theconfiguredsessionauthorizationparametersaresentbythe
clienttotheTACACS+server.Theparametervaluesmustmatchaserviceandaccesslevel
attribute‐valuepairconfiguredon
theserverforthesessiontobeauthorized.Iftheparameter
valuesdonotmatch,thesessionisnotallowed.
Theservicenameandattribute‐valuepairscanbeanycharacterstring,andaredeterminedby
yourTACACS+serverconfiguration.
Whensessionaccountingisenabled,theTACACS+ serverlogsaccountinginformation,
suchas
startandstoptimes,IPaddressoftheremoteuser,andsoforth,foreachauthorizedclientsession.
Command Authorization and Accounting
TACACS+commandauthorizationandaccountingcanoccuronlyduringaTACACS+authorized
session.
Whencommandauthorizationisenabled,theTACACS+servercheckswhethereachcommandis
permittedforthatauthorizedsessionandreturnsasuccessorfailureforeachone.Ifthe
authorizationfails,thecommandisnotexecuted.
Whencommandaccounting
isenabled,theTACACS+serverlogsaccountinginformation,suchas
thecommandstringandIPaddressoftheremoteuserforeachcommandexecutedduringthe
session.