Configuring TACACS+ Server Groups
You can specify one or more remote AAA servers to authenticate users using server groups. All members of
a group must belong to the TACACS+ protocol. The servers are tried in the same order in which you configure
them.
You can configure these server groups at any time but they only take effect when you apply them to an AAA
service.
Before You Begin
You must use the feature tacacs+ command to enable TACACS+ before you configure TACACS+.
Procedure
PurposeCommand or Action
Enters global configuration mode.switch# configure terminal
Step 1
Creates a TACACS+ server group and enters the
TACACS+ server group configuration mode for that group.
switch(config)# aaa group server
tacacs+ group-name
Step 2
(Optional)
Configures the monitoring dead time. The default is 0
minutes. The range is from 0 through 1440.
switch(config-tacacs+)# deadtime
minutes
Step 3
If the dead-time interval for a TACACS+ server
group is greater than zero (0), that value takes
precedence over the global dead-time value.
Note
(Optional)
Assigns a source interface for a specific TACACS+ server
group.
switch(config-tacacs+)#
source-interface interface
Step 4
The supported interface types are management and VLAN.
Use the source-interface command to override
the global source interface assigned by the ip
tacacs source-interface command.
Note
Exits configuration mode.switch(config-tacacs+)# exit
Step 5
(Optional)
Displays the TACACS+ server group configuration.
switch(config)# show tacacs-server
groups
Step 6
(Optional)
Copies the running configuration to the startup
configuration.
switch(config)# copy
running-config startup-config
Step 7
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
51
Configuring TACACS+
TACACS+ Server Configuration Process
To Next Page
Loading...
