Users Guide

Authentication, Authorization, and Accounting 275
Figure 9-2 shows an example of access management using TACACS+.
Figure 9-2. Basic TACACS+ Topology
The TACACS+ server list can be configured with one or more hosts defined
via their network IP addresses. Each can be assigned a priority to determine
the order in which the TACACS+ client will contact the servers. TACACS+
contacts the server when a connection attempt fails or times out for a higher
priority server.
Each server host can be configured with a specific connection type, port,
timeout, and shared key, or the server hosts can be globally configured with
the key and timeout.
The TACACS+ server can do the authentication itself, or redirect the request
to another back-end device. All sensitive information is encrypted and the
shared secret is never passed over the network; it is used only to encrypt the
data.
Which TACACS+ Attributes Does the Switch Support?
Table 9-7 lists the TACACS+ attributes that the switch supports and
indicates whether the authorization or accounting service supports sending or
receiving the attribute. The authentication service does not use attributes.
The following attributes can be configured on the TACACS+ server(s) when
utilizing the switch TACACS+ service.
Management Host
Primary TACACS+ Server
Backup TACACS+ Server
Management
Network
Dell EMC Networking N-Series
switch