Basic Cisco Tacacs+ Configuration With Free Tacacs+ Software for Windows - Part 1

Both RADIUS and TACACS+ provides centralized validation of users attempting to gain access to a both protocols supported network devices, which provides Authentication, Authorization, and Accounting (AAA) services on network devices.

RADIUS stands for Remote Access Dial-In User Service, and TACACS+ stands for Terminal Access Controller Access Control Service Plus. The primary functional difference between RADIUS and TACACS+ is that TACACS+ separates out the Authorization functionality, where RADIUS combines both Authentication and Authorization. RADIUS was designed for subscriber AAA, and TACACS+ is designed for administrator AAA. RADIUS can still be used for small network administrator AAA, but only if authorization is not required, or if it is a homogeneous network (all one vendor). In any scenario where there is a heterogeneous environment or authorization policies are required for network devices, TACACS+ is the best option.

The following figure and table show their difference more instinctively:

(from http://www.tacacs.net/docs/TACACS+Advantages.pdf)

This post shows the basic Tacacs+ configuration steps on a cisco 2960 switch to work with Free Tacacs+ Software for Windows:

Step1: Software Installation and verify configuration

a. Download Software

Version 1.3.2 is at http://www.tacacs.net/ware/TACACSSetup_v1.3.2.zip

b. Installation

Double click TACACSSetup_v1.3.2.zip file and simply clieck next to follow the wizard to complete the installation.

After installation, TACACS.net service will automatically start. Localhost (127.0.0.1) and RFC 1918 IP address ranges (172.16.0.0/12, 192.168.0.0/16, 10.0.0.0/8) are already added as clients by default. Any user in the Administrators group on the local machine will be authorized as the fallback method.

c. Configuration Tacacs+ server

The wizard will install the configuration and log files to different locations depending on your OS. Start Menu TACACS.net program group has a configuration shortcut to point to the configuration folder. In my case, all configuration files was installed at this directory: C:\ProgramData\TACACS.net\config

Check tacplus.xml to make sure server ip is not 127.0.0.1.

You do not need to restart/reload the server when you modify the configuration files. The server
monitors for changes to the configuration files and reloads them automatically.

d. Verify Tacacs service

telnet 127.0.0.1 49
tactest -s 10.94.200.14 -u test1 -p test1

(test1 is the local administrator account in the Tacacs windows server)

Step 2: Configure Switch to use Tacacs server

Router(config)# aaa new-model
Router(config)# tacacs-server host 10.94.200.14 key mysharedsecret
Router(config)# aaa authentication login default group tacacs+ local
Router(config)# aaa authorization exec default group tacacs+ local
Router(config)# line console 0
Router(config-line)# login authentication default
Router(config)# line vty 0 15
Router(config-line)# login authentication default

Based on above configuration steps 1 and step 2, the switch will be authenticated with Tacacs server's account in the local administrators group.

Notes:

Fallback group includes all local administrators on the server. It should be commented out before it is deployed in production.