Connectivity Guide

TACACS+ authentication
Congure a TACACS+ authentication server by entering the server's IP address or host name. You must also enter a text string for the key
used to authenticate the OS10 switch on a TACACS+ host. The TCP port entry is optional.
TACACS+ provides greater data security by encrypting the entire protocol portion in a packet sent from the switch to an authentication
server. RADIUS encrypts only passwords.
• Congure a TACACS+ authentication server in CONFIGURATION mode. By default, a TACACS+ server uses TCP port 49 for
authentication.
tacacs-server host {hostname | ip-address} key {0 authentication-key | 9 authentication-key
| authentication-key} [auth-port port-number]
Re-enter the tacacs-server host command multiple times to congure more than one TACACS+ server. If you congure multiple
TACACS+ servers, OS10 attempts to connect in the order you congured them. An OS10 switch connects with the congured TACACS
+ servers one at a time, until a TACACS+ server responds with an accept or reject response.
• Congure the global timeout used to wait for an authentication response from TACACS+ servers in CONFIGURATION mode, from 1 to
1000 seconds; default 5.
tacacs-server timeout seconds
• (Optional) Congure an arbitrary IP address as the source interface used in TACACS+ connections in CONFIGURATION mode. The IP
address of the specied interface is included in the IP header of TACACS+ packets without changing the source IP address. The ip
tacacs source-interfacecommand is optional for TACACS+-based user authentication. TACACS+ authentication is still
performed if you do not specify an IP TACACS+ source interface.
ip radius source-interface interface
Congure TACACS+ server
OS10(config)# tacacs-server host 1.2.4.5 key mysecret
OS10(config)# ip tacacs source-interface loopback 2
View TACACS+ server conguration
OS10# show running-configuration
...
tacacs-server host 1.2.4.5 key 9
3a95c26b2a5b96a6b80036839f296babe03560f4b0b7220d6454b3e71bdfc59b
ip tacacs source-interface loopback 2
...
Delete TACACS+ server
OS10# no tacacs server host 1.2.4.5
TACACS+ unknown or missing user role
When a TACACS+ server authenticates a user and does not return a role or returns an unknown role, OS10 assigns the netoperator role
to the user by default. You can recongure the default assigned role and the associated permissions. In addition, you can congure a
specied TACACS+ user-role name to inherit the permissions of an existing OS10 system-dened role.
• Enter an OS10 user role in CONFIGURATION mode.
userrole {default | name} inherit existing-role-name
– default inherit — Recongure the default permissions assigned to an authenticated user with a missing or unknown
TACACS+ role.
– name inherit — Enter the name of the TACACS+ user role that inherits permissions from an OS10 user role; 32 characters
maximum.
– existing-role-name — Assign the permissions associated with an existing OS10 user role:
System management
617