Access Security Guide K/KA/KB.15.15

Figure 104 Example of the switch after assigning a different "first-choice" server
To remove the 10.28.227.15 device as a TACACS+ server, you would use this command:
HPswitch(config)# no tacacs-server host 10.28.227.15
Using the encryption key
General operation
When used, the encryption key (sometimes termed "key", "secret key", or "secret") helps to prevent
unauthorized intruders on the network from reading username and password information in
TACACS+ packets moving between the switch and a TACACS+ server. At the TACACS+ server,
a key may include both of the following:
• Global key: A general key assignment in the TACACS+ server application that applies to all
TACACS-aware devices for which an individual key has not been configured.
• Server-Specific key: A unique key assignment in the TACACS+ server application that applies
to a specific TACACS-aware device.
NOTE: Configure a key in the switch only if the TACACS+ server application has this exact same
key configured for the switch. That is, if the key parameter in switch "X" does not exactly match
the key setting for switch "X" in the TACACS+ server application, then communication between
the switch and the TACACS+ server will fail.
Thus, on the TACACS+ server side, you have a choice as to how to implement a key. On the switch
side, it is necessary only to enter the key parameter so that it exactly matches its counterpart in the
server. For information on how to configure a general or individual key in the TACACS+ server,
see the documentation you received with the application.
Encryption options in the switch
When configured, the encryption key causes the switch to encrypt the TACACS+ packets it sends
to the server. When left at "null", the TACACS+ packets are sent in clear text. The encryption key
(or just "key") you configure in the switch must be identical to the encryption key configured in the
corresponding TACACS+ server. If the key is the same for all TACACS+ servers the switch will use
for authentication, then configure a global key in the switch. If the key is different for one or more
of these servers, use "server-specific" keys in the switch. (If you configure both a global key and
one or more per-server keys, the per-server keys will override the global key for the specified
servers.)
For example, you would use the next command to configure a global encryption key in the switch
to match a key entered as north40campus in two target TACACS+ servers. (That is, both servers
use the same key for your switch.) Note that you do not need the server IP addresses to configure
a global key in the switch:
HPswitch(config)# tacacs-server key north40campus
Suppose that you subsequently add a third TACACS+ server (with an IP address of 10.28.227.87)
that has south10campus for an encryption key. Because this key is different than the one used for
Using TACACS+ 133