Table Of Contents

Authentication, Authorization, and Accounting Commands on Cisco IOS XR Software

aaa accounting

aaa accounting system default

aaa authentication

aaa authorization

aaa default-taskgroup

aaa group server radius

aaa group server tacacs+

accounting

authorization

description (AAA)

group

inherit taskgroup

inherit usergroup

login authentication

password (AAA)

radius-server host

radius-server key

radius-server retransmit

radius-server timeout

radius source-interface

secret

server (RADIUS)

server (TACACS+)

show aaa

show radius

show radius server-groups

show tacacs

show tacacs server-groups

show task supported

show user

tacacs-server host

tacacs-server key

tacacs-server timeout

tacacs source-interface

task

taskgroup

timeout login response

usergroup

username

users group

Authentication, Authorization, and Accounting Commands on Cisco IOS XR Software

---

This chapter describes the Cisco IOS XR software commands used to configure authentication, authorization, and accounting (AAA) services.

For detailed information about AAA concepts, configuration tasks, and examples, see the Configuring AAA Services on Cisco IOS XR Software configuration module.

aaa accounting

To create a method list for accounting, use the aaa accounting command in global configuration mode. To remove a list name from the system, use the no form of this command.

aaa accounting {commands | exec} {default | list-name} {start-stop | stop-only}
{none | group {tacacs+ | radius | group-name}}

no aaa accounting {commands | exec} {default | list-name}

Syntax Description

commands	Enables accounting for EXEC shell commands.
exec	Enables accounting of an EXEC session.
default	Uses the listed accounting methods that follow this keyword as the default list of methods for accounting services.
list-name	Character string used to name the accounting method list.
start-stop	Sends a "start accounting" notice at the beginning of a process and a "stop accounting" notice at the end of a process. The requested user process begins regardless of whether the "start accounting" notice was received by the accounting server.
stop-only	Sends a "stop accounting" notice at the end of the requested user process.
none	Uses no accounting.
group tacacs+	Uses the list of all TACACS+ servers for accounting.
group radius	Uses the list of all RADIUS servers for accounting.
group group-name	Uses a named subset of TACACS+ or RADIUS servers for accounting, as defined by the aaa group server tacacs+ or aaa group server radius command.

Defaults

AAA accounting is disabled.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the aaa accounting command to create default or named method lists defining specific accounting methods and that can be used on a per-line or per-interface basis. You can specify up to four methods in the method list. The list name can be applied to a line (console, aux, or vty template) to enable accounting on that particular line.

The Cisco IOS XR software supports both TACACS+ and RADIUS methods for accounting. The router reports user activity to the security server in the form of accounting records, which are stored on the security server.

Method lists for accounting define the way accounting is performed, enabling you to designate a particular security protocol to be used on specific lines or interfaces for particular types of accounting services.

For minimal accounting, include the stop-only keyword to send a "stop accounting" notice after the requested user process. For more accounting, you can include the start-stop keyword, so that TACACS+ or RADIUS sends a "start accounting" notice at the beginning of the requested process and a "stop accounting" notice after the process. The accounting record is stored only on the TACACS+ or RADIUS server.

The requested user process begins regardless of whether the "start accounting" notice was received by the accounting server.

---

Note This command cannot be used with TACACS or extended TACACS.

---

Examples

The following example shows how to define a default commands accounting method list, where accounting services are provided by a TACACS+ security server, with a stop-only restriction:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa accounting commands default stop-only group tacacs+

Related Commands

Command	Description
aaa authorization	Creates a method list to be used for authorization.

aaa accounting system default

To enable authentication, authorization, and accounting (AAA) system accounting, use the aaa accounting system default command in global configuration mode. To disable system accounting, use the no form of this command.

aaa accounting system default {start-stop | stop-only} {none | group {tacacs+ | radius | group-name}}

no aaa accounting system default

Syntax Description

start-stop	Sends a "start accounting" notice during system bootup and a "stop accounting" notice during system shutdown or reload.
stop-only	Sends a "stop accounting" notice during system shutdown or reload.
none	Uses no accounting.
group tacacs+	Uses the list of all TACACS+ servers for accounting.
group radius	Uses the list of all RADIUS servers for accounting.
group group-name	Uses a named subset of TACACS+ or RADIUS servers for accounting, as defined by the aaa group server tacacs+ or aaa group server radius command.

Defaults

AAA accounting is disabled.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

System accounting does not use named accounting lists; you can define only the default list for system accounting.

The default method list is automatically applied to all interfaces or lines. If no default method list is defined, then no accounting takes place.

You can specify up to four methods in the method list.

Examples

The following example shows how to cause a "start accounting" record to be sent to a TACACS+ server when a router initially boots. A "stop accounting" record is also sent when a router is shut down or reloaded.

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa accounting system default start-stop group tacacs+

Related Commands

Command	Description
aaa authentication	Creates a method list for authentication.
aaa authorization	Creates a method list for authorization.

aaa authentication

To create a method list for authentication, use the aaa authentication command in global configuration mode. To disable this authentication method, use the no form of this command.

aaa authentication {login | ppp} {default | remote | list-name} {local | line | group {tacacs+ | radius | group-name}}

no aaa authentication {login | ppp} {default | remote | list-name}

Syntax Description

login	Sets authentication for login.
ppp	Sets authentication for Point-to-Point Protocol.
default	Uses the listed authentication methods that follow this keyword as the default list of methods for authentication.
remote	Uses the listed authentication methods that follow this keyword as the default list of methods for administrative authentication on a remote nonowner logical router.
list-name	Character string used to name the authentication method list.
local	Specifies a method list that uses the local username database method for authentication. The local authentication cannot fail because the system always ensures at least one user is present in the local database, and a rollover cannot happen beyond the local method.
line	Specifies a method list that uses the line password for authentication.
group tacacs+	Specifies a method list that uses the list of all configured TACACS+ servers for authentication.
group radius	Specifies a method list that uses the list of all configured RADIUS servers for authentication.
group group-name	Specifies a method list that uses a named subset of TACACS+ or RADIUS servers for authentication as defined by the aaa group server tacacs+ or aaa group server radius command.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the aaa authentication command to create a series of authentication methods, or method list. You can specify up to four methods in the method list. A method list is a named list describing the authentication methods to be used (such as TACACS+ or RADIUS), in sequence. The subsequent methods of authentication are used only if the initial method is not available, not if it fails.

The default method list is applied for all interfaces for authentication, except when a different named method list is explicitly specified, in which case the explicitly specified method list overrides the default list.

For console access, if no authentication is configured, a default of local method is applied.

---

Note The group tacacs+, group radius, and group group-name forms of this command refer to a set of previously defined TACACS+ or RADIUS servers. Use the tacacs-server host or radius-server host command to configure the host servers. Use the aaa group server tacacs+ or aaa group server radius command to create a named subset of servers.

---

Examples

The following example shows how to specify the default method list to be used for authentication, and also enable authentication for console:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa authentication login default group tacacs+

Related Commands

Command	Description
aaa accounting	Creates a method list for accounting.
aaa authorization	Creates a method list for authorization.
aaa group server radius	Groups different RADIUS server hosts into distinct lists and distinct methods.
aaa group server tacacs+	Groups different TACACS+ server hosts into distinct lists and distinct methods.
login authentication	Enables AAA authentication for logins.
radius-server host	Specifies a RADIUS host.
tacacs-server host	Specifies a TACACS+ host.

aaa authorization

To create a method list for authorization, use the aaa authorization command in global configuration mode. To disable authorization for a function, use the no form of this command.

aaa authorization {commands | exec | network} {default | list-name} {none | local | group {tacacs+ | radius | group-name}}

no aaa authorization {commands | exec | network} {default | list-name}

Syntax Description

commands	Configures authorization for all EXEC shell commands.
exec	Configures authorization for an interactive (EXEC) session.
network	Configures authorization for network services, such as PPP or Internet Key Exchange (IKE).
default	Uses the listed authorization methods that follow this keyword as the default list of methods for authorization.
list-name	Character string used to name the list of authorization methods.
none	Uses no authorization. If you specify none, no subsequent authorization methods is attempted. However, the task ID authorization is always required and cannot be disabled.
local	Uses local authorization. This method of authorization is not available for command authorization.
group tacacs+	Uses the list of all configured TACACS+ servers for authorization.
group radius	Uses the list of all configured RADIUS servers for authorization. This method of authorization is not available for command authorization.
group group-name	Uses a named subset of TACACS+ or RADIUS servers for authorization as defined by the aaa group server tacacs+ or aaa group server radius command.

Defaults

Authorization is disabled for all actions (equivalent to the method none keyword).

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the aaa authorization command to create method lists defining specific authorization methods that can be used on a per-line or per-interface basis. You can specify up to four methods in the method list.

---

Note The command authorization mentioned here applies to the one performed by an external AAA server and not for task-based authorization.

---

Method lists for authorization define the ways authorization will be performed and the sequence in which these methods will be performed. A method list is a named list describing the authorization methods to be used (such as TACACS+), in sequence. Method lists enable you to designate one or more security protocols to be used for authorization, thus ensuring a backup system in case the initial method fails. The Cisco IOS XR software uses the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS XR software selects the next method listed in the method list. This process continues until there is successful communication with a listed authorization method or all methods defined have been exhausted.

---

Note The Cisco IOS XR software attempts authorization with the next listed method only when there is no response (not a failure) from the previous method. If authorization fails at any point in this cycle—meaning that the security server or local username database responds by denying the user services—the authorization process stops and no other authorization methods are attempted.

---

The Cisco IOS XR software supports the following methods for authorization:

•none—The router does not request authorization information; authorization is not performed over this line or interface.

•local—Use local database for authorization.

•group tacacs+—Use the list of all configured TACACS+ servers for authorization.

•group radius—Use the list of all configured RADIUS servers for authorization.

•group group-name—Uses a named subset of TACACS+ or RADIUS servers for authorization.

Method lists are specific to the type of authorization being requested. The Cisco IOS XR software supports three types of AAA authorization:

•Commands authorization: Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands.

---

Note "Command" authorization is distinct from "task-based" authorization, which is based on the task profile established during authentication.

---

•EXEC authorization: Applies authorization for starting an EXEC session.

•Network authorization: Applies authorization for network services, such as IKE.

When you create a named method list, you are defining a particular list of authorization methods for the indicated authorization type. Once defined, method lists must be applied to specific lines or interfaces before any of the defined methods will be performed.

The aaa authorization commands command causes a request packet containing a series of AV pairs to be sent to the TACACS+ server as part of the authorization process. The server can do one of the following:

•Accept the request as is.

•Make changes to the request.

•Refuse the request and refuse authorization.

Examples

The following example shows how to define the network authorization method list named listname1, which specifies that TACACS+ authorization is used:

RP/0/RP0/CPU0:router(config)# aaa authorization commands listname1 group tacacs+

Related Commands

Command	Description
aaa accounting	Creates a method list for accounting.

aaa default-taskgroup

To specify a task group to be used for remote TACACS+ authentication, use the aaa default-taskgroup command in global configuration mode. To remove this default task group, enter the no form of this command.

aaa default-taskgroup taskgroup-name

no aaa default-taskgroup taskgroup-name

Syntax Description

taskgroup-name

Name of an existing task group.

Defaults

No default task group is assigned for remote authentication.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the aaa default-taskgroup command to specify an existing task group to be used for remote TACACS+ authentication.

Examples

The following example shows how to specify taskgroup1 as the default task group for remote TACACS+ authentication:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa default-taskgroup taskgroup1

aaa group server radius

To group different RADIUS server hosts into distinct lists, enter the aaa group server radius command in global configuration mode. To remove a group server from the configuration list, enter the no form of this command.

aaa group server radius group-name

no aaa group server radius group-name

Syntax Description

group-name

Character string used to name the group of servers.

Defaults

This command is not enabled.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the aaa group server radius command to group existing server hosts, which allows you to select a subset of the configured server hosts and use them for a particular service. A server group is used in conjunction with a global server-host list. The server group lists the IP addresses or hostnames of the selected server hosts.

Server groups can also include multiple host entries for the same server, as long as each entry has a unique identifier. The combination of an IP address and User Datagram Protocol (UDP) port number creates a unique identifier, allowing different ports to individually defined as RADIUS hosts providing a specific authentication, authorization, and accounting (AAA) service. In other words, this unique identifier enables RADIUS requests to be sent to different UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service, for example, accounting, the second host entry acts as a failover backup to the first host entry. Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry on the same device for accounting services. The RADIUS host entries are tried in the order in which they are configured in the server group.

All members of a server group must be the same type, that is, RADIUS.

The server group cannot be named radius or tacacs.

This command enters server group configuration mode, where the server command (associates a particular RADIUS server with the defined server group) is available.

Examples

The following example shows the configuration of an AAA group server named radgroup1, which comprises three member servers:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa group server radius radgroup1

RP/0/RP0/CPU0:router(config-sg-radius)# server 10.0.0.5 auth-port 1700 acct-port 1701

RP/0/RP0/CPU0:router(config-sg-radius)# server 10.0.0.10 auth-port 1702 acct-port 1703

RP/0/RP0/CPU0:router(config-sg-radius)# server 10.0.0.20 auth-port 1705 acct-port 1706

---

Note If the auth-port port-number keyword and argument and the acct-port port-number keyword and argument are not specified, the default value of the port-number argument for the auth-port keyword is 1645 and the default value of the port-number argument for the acct-port keyword is 1646.

---

Related Commands

Command	Description
radius-server host	Specifies a RADIUS server host.

aaa group server tacacs+

To group different TACACS+ server hosts into distinct lists, use the aaa group server tacacs+ command in global configuration mode. To remove a server group from the configuration list, enter the no form of this command.

aaa group server tacacs+ group-name

no aaa group server tacacs+ group-name

Syntax Description

group-name

Character string used to name a group of servers.

Defaults

This command is not enabled.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The AAA server-group feature introduces a way to group existing server hosts. The feature enables you to select a subset of the configured server hosts and use them for a particular service.

The aaa group server tacacs+ command enters server group configuration mode, where the server command (associates a particular TACACS+ server with the defined server group) is available.

A server group is a list of server hosts of a particular type. The supported server host type is TACACS+ server hosts. A server group is used with a global server host list. The server group lists the IP addresses or hostnames of the selected server hosts.

The server group cannot be named radius or tacacs.

---

Note Group name methods refer to a set of previously defined TACACS+ servers. Use the tacacs-server host command to configure the host servers.

---

Examples

The following example shows the configuration of an AAA group server named tacgroup1, which comprises three member servers:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa group server tacacs+ tacgroup1

RP/0/RP0/CPU0:router(config-sg-tacacs+)# server 192.168.200.226

RP/0/RP0/CPU0:router(config-sg-tacacs+)# server 192.168.200.227

RP/0/RP0/CPU0:router(config-sg-tacacs+)# server 192.168.200.228

Related Commands

Command	Description
aaa accounting	Creates a method list for accounting.
aaa authentication	Creates a method list for authentication.
aaa authorization	Creates a method list for authorization.
server (TACACS+)	Specifies the host name or IP address of an external TACACS+ server.
tacacs-server host	Specifies a TACACS+ host.

accounting

To enable authentication, authorization, and accounting (AAA) accounting services for a specific line or group of lines, use the accounting command in line configuration mode. To disable AAA accounting services, use the no form of this command.

accounting {commands | exec} {default | list-name}

no accounting {commands | exec} {default | list-name}

Syntax Description

commands	Enables accounting on the selected lines for all EXEC shell commands.
exec	Enables accounting of an EXEC session.
default	The name of the default method list, created with the aaa accounting command.
list-name	Specifies the name of a list of accounting methods to use. The list is created with the aaa accounting command.

Defaults

Accounting is disabled.

Command Modes

Line configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

After you enable the aaa accounting command and define a named accounting method list (or use the default method list) for a particular type of accounting, you must apply the defined lists to the appropriate lines for accounting services to take place. Use the accounting command to apply the specified method lists to the selected line or group of lines. If a method list is not specified this way, no accounting is applied to the selected line or group of lines.

Examples

The following example shows how to enable command accounting services using the accounting method list named listname2 on a line template named configure:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# line template configure

RP/0/RP0/CPU0:router(config-line)# accounting commands listname2

Related Commands

Command	Description
aaa accounting	Creates a method list for accounting.

authorization

To enable authentication, authorization, and accounting (AAA) authorization for a specific line or group of lines, use the authorization command in line configuration mode. To disable authorization, use the no form of this command.

authorization {commands | exec} {default | list-name}

no authorization {commands | exec} {default | list-name}

Syntax Description

commands	Enables authorization on the selected lines for all commands.
exec	Enables authorization for an interactive (EXEC) session.
default	Applies the default method list, created with the aaa authorization command.
list-name	Specifies the name of a list of authorization methods to use. If no list name is specified, the system uses the default. The list is created with the aaa authorization command.

Defaults

Authorization is not enabled.

Command Modes

Line configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

After you use the aaa authorization command to define a named authorization method list (or use the default method list) for a particular type of authorization, you must apply the defined lists to the appropriate lines for authorization to take place. Use the authorization command to apply the specified method lists (or, if none is specified, the default method list) to the selected line or group of lines.

Examples

The following example shows how to enable command authorization using the method list named listname4 on a line template named configure:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# line template configure

RP/0/RP0/CPU0:router(config-line)# authorization commands listname4

Related Commands

Command	Description
aaa authorization	Creates a method list for authorization.

description (AAA)

To create a description of a task group or user group during configuration, use the description command in task group configuration or user group configuration mode. To delete a task group description or user group description, use the no form of this command.

description string

no description

Syntax Description

string

Character string describing the task group or user group.

Defaults

The default description is blank.

Command Modes

Task group configuration
User group configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the description command inside the task or user group configuration submode to define a description for the task or user group, respectively.

Examples

The following example shows the creation of a task group description:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# taskgroup alpha

RP/0/RP0/CPU0:router(config-tg)# description this is a sample taskgroup

The following example shows the creation of a user group description:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# usergroup alpha

RP/0/RP0/CPU0:router(config-ug)# description this is a sample user group

Related Commands

Command	Description
taskgroup	Accesses task group configuration mode and configures a task group by associating it with a set of task IDs.
usergroup	Accesses user group configuration mode and configures a user group by associating it with a set of task groups.

group

To add a user to a group, use the group command in username configuration mode. To remove the user from a group, use the no form of this command.

group {root-system | root-lr | netadmin | sysadmin | operator | cisco-support | group-name}

no group {root-system | root-lr | netadmin | sysadmin | operator | cisco-support | group-name}

Syntax Description

root-system	Adds the user to the predefined root-system group. Only users with root-system authority may use this option.
root-lr	Adds the user to the predefined root-lr group. Only users with root-system authority or root-lr authority may use this option.
netadmin	Adds the user to the predefined network administrators group.
sysadmin	Adds the user to the predefined system administrators group.
operator	Adds the user to the predefined operator group.
cisco-support	Adds the user to the predefined Cisco support personnel group.
group-name	Adds the user to a named user group that has already been defined with the usergroup command.

Defaults

No default behavior or values

Command Modes

Username configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The predefined group root-system may be specified only by root-system users while configuring administration.

Use the group command in username configuration mode. To access username configuration mode, use the username command in global configuration mode.

If the group command is used in admin configuration mode, only root-system and cisco-support can be specified.

Examples

The following example shows how to assign the user group operator to the user named user1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# username user1

RP/0/RP0/CPU0:router(config-un)# group operator

Related Commands

Command	Description
password (AAA)	Creates a login password for a user.
usergroup	Configures a user group and associates it with a set of task groups.
username	Accesses username configuration mode, configures a new user with a username, and establishes a password and permissions for that user.

inherit taskgroup

To enable a task group to derive permissions from another task group, use the inherit taskgroup command in task group configuration mode.

inherit taskgroup {taskgroup-name | netadmin | operator | sysadmin | cisco-support | root-lr | root-system}

Syntax Description

taskgroup-name	Name of the task group from which permissions are inherited.
netadmin	Inherits permissions from the network administrator task group.
operator	Inherits permissions from the operator task group.
sysadmin	Inherits permissions from the system administrator task group.
cisco-support	Inherits permissions from the cisco support task group.
root-lr	Inherits permissions from the root LR task group.
root-system	Inherits permissions from the root system task group.

Defaults

No default behavior or values

Command Modes

Task group configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the inherit taskgroup command to inherit the permissions (task IDs) from one task group into another task group.

Examples

In the following example, the permissions of task group tg2 are inherited by task group tg1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# taskgroup tg1

RP/0/RP0/CPU0:router(config-tg)# inherit taskgroup tg2 
RP/0/RP0/CPU0:router(config-tg)# end

inherit usergroup

To enable a user group to derive characteristics of another user group, use the inherit usergroup command in user group configuration mode.

inherit usergroup usergroup-name

Syntax Description

usergroup-name

Name of the user group from which permissions are to be inherited.

Defaults

No default behavior or values

Command Modes

User group configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Each user group is associated with a set of task groups applicable to the users in that group. A task group is defined by a collection of task IDs. Task groups contain task ID lists for each class of action. The task permissions for a user are derived (at the start of the EXEC or XML session) from the task groups associated with the user groups to which that user belongs.

User groups support inheritance from other user groups. Use the inherit usergroup command to copy permissions (task ID attributes) from one user group to another user group. The "destination" user group inherits the properties of the inherited group and forms a union of all task IDs specified in those groups. For example, when user group A inherits user group B, the task map of the user group A is a union of that of A and B. Cyclic inclusions are detected and rejected. User groups cannot inherit properties from predefined groups, such as root-system users, root-lr users, netadmin users, and so on.

Examples

The following example shows how to enable the purchasing user group to inherit properties from the sales user group:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# usergroup purchasing

RP/0/RP0/CPU0:router(config-ug)# inherit usergroup sales

Related Commands

Command	Description
description (AAA)	Creates a description of a task group in task group configuration mode, or creates a description of a user group in user group configuration mode.
taskgroup	Configures a task group to be associated with a set of task IDs.
usergroup	Configures a user group to be associated with a set of task groups.

login authentication

To enable authentication, authorization, and accounting (AAA) authentication for logins, use the login authentication command in line configuration mode. To return to the default authentication settings, use the no form of this command.

login authentication {default | list-name}

no login authentication {default | list-name}

Syntax Description

default	Default list of AAA authentication methods, as set by the aaa authentication login command.
list-name	Name of the method list used for authenticating. You specify this list with the aaa authentication login command

Defaults

This command uses the default set with the aaa authentication login command.

Command Modes

Line configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The login authentication command is a per-line command used with AAA that specifies the name of a list of AAA authentication methods to try at login.

---

Caution If you use a list-name value that was not configured with the aaa authentication login command, the configuration is rejected.

---

Entering the no form of the login authentication command has the same effect as entering the command with the default keyword.

Before issuing this command, create a list of authentication processes by using the aaa authentication login global configuration command.

Examples

The following example shows that the default AAA authentication is to be used for the line template template1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# line template template1

RP/0/RP0/CPU0:router(config-line)# login authentication default

The following example shows that the AAA authentication list called list1 is to be used for the line template template2:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# line template template2

RP/0/RP0/CPU0:router(config-line)# login authentication list1

Related Commands

Command	Description
aaa authentication	Creates a method list for authentication.

password (AAA)

To create a login password for a user, use the password command in username or line configuration mode. To remove the password, use the no form of this command.

password {0 | 7} password

no password {0 | 7} password

Syntax Description

0	Specifies that an unencrypted (clear-text) password follows.
7	Specifies that a two-way encrypted password follows.
password	Character-string password to be entered by the user to log in.

Defaults

No password is specified.

Command Modes

Username configuration
Line configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

You can specify one of two types of passwords: encrypted or clear text.

When an EXEC process is started on a line that has password protection, the process prompts for the password. If the user enters the correct password, the process issues the prompt. The user can try three times to enter a password before the process exits and returns the terminal to the idle state.

Passwords are two-way encrypted and should be used for applications such as PPP that need decryptable passwords.

Examples

The following example shows how to establish the unencrypted password pwd1 for the user user1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# username user1

RP/0/RP0/CPU0:router(config-un)# password 0 pwd1

Related Commands

Command	Description
group	Adds a user to a group.
usergroup	Accesses user group configuration mode and configures a user group, associating it with a set of task groups.
username	Accesses username configuration mode and configures a new user with a username, establishing a password and granting permissions for that user.

radius-server host

To specify a RADIUS server host, use the radius-server host command in global configuration mode. To delete the specified RADIUS host, use the no form of this command.

radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string]

no radius-server host {hostname | ip-address}

Syntax Description

hostname	Domain Name System (DNS) name of the RADIUS server host.
ip-address	IP address of the RADIUS server host.
auth-port port-number	(Optional) Specifies the User Datagram Protocol (UDP) destination port for authentication requests; the host is not used for authentication if set to 0. If unspecified, the port number defaults to 1645.
acct-port port-number	(Optional) Specifies the UDP destination port for accounting requests; the host is not used for accounting if set to 0. If unspecified, the port number defaults to 1646.
timeout seconds	(Optional) The time interval (in seconds) that the router waits for the RADIUS server to reply before retransmitting. This setting overrides the global value of the radius-server timeout command. If no timeout value is specified, the global value is used. Enter a value in the range from 1 to 1000. Default is 5.
retransmit retries	(Optional) The number of times a RADIUS request is re-sent to a server, if that server is not responding or responding slowly. This setting overrides the global setting of the radius-server retransmit command. If no retransmit value is specified, the global value is used. Enter a value in the range from 1 to 100. Default is 3.
key string	(Optional) Specifies the authentication and encryption key used between the router and the RADIUS server. This key overrides the global setting of the radius-server key command. If no key string is specified, the global value is used. The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command syntax. This is because the leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in the key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.

Defaults

No RADIUS host is specified; use global radius-server command values.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

You can use multiple radius-server host commands to specify multiple hosts. The Cisco IOS XR software searches for hosts in the order in which you specify them.

If no host-specific timeout, retransmit, or key values are specified, the global values apply to each host.

Examples

The following example shows how to establish host1 as the RADIUS server and use default ports for both accounting and authentication:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# radius-server host host1

The following example shows how to establish port 1612 as the destination port for authentication requests and port 1616 as the destination port for accounting requests on the RADIUS host named host1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# radius-server host host1 auth-port 1612 acct-port 1616

Because entering a line resets all the port numbers, you must specify a host and configure accounting and authentication ports on a single line.

The following example shows how to establish the host with IP address 172.29.39.46 as the RADIUS server, use ports 1612 and 1616 as the authorization and accounting ports, set the timeout value to 6, set the retransmit value to 5, and set "rad123" as the encryption key, matching the key on the RADIUS server:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# radius-server host 172.29.39.46 auth-port 1612 acct-port 
1616 timeout 6 retransmit 5 key rad123

To use separate servers for accounting and authentication, use the zero port value as appropriate.

The following example shows how to establish that RADIUS server host1 be used for accounting but not for authentication, and specify that RADIUS server host2 be used for authentication but not for accounting:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# radius-server host host1.example.com auth-port 0

RP/0/RP0/CPU0:router(config)# radius-server host host2.example.com acct-port 0

Related Commands

Command	Description
aaa accounting	Creates a method list for accounting.
aaa authentication	Creates a method list for authentication.
aaa authorization	Creates a method list for authorization.
radius-server key	Sets the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon.
radius-server retransmit	Specifies how many times the Cisco IOS XR software retransmits packets to a server before giving up.
radius-server timeout	Sets the interval a router waits for a server host to reply.

radius-server key

To set the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon, use the radius-server key command in global configuration mode. To disable the key, use the no form of this command.

radius-server key {0 clear-text-key | 7 encrypted-key | clear-text-key}

no radius-server key

Syntax Description

0 clear-text-key	Specifies an unencrypted (cleartext) shared key.
7 encrypted-key	Specifies a encrypted shared key.
clear-text-key	Specifies an unencrypted (cleartext) shared key.

Defaults

The authentication and encryption key is disabled.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The key entered must match the key used on the RADIUS server. All leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.

Examples

The following example shows how to set the cleartext key to "samplekey":

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# radius-server key 0 samplekey

The following example shows how to set the encrypted shared key to "anykey":

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# radius-server key 7 anykey

Related Commands

Command	Description
radius-server host	Specifies a RADIUS server host.

radius-server retransmit

To specify the number of times the Cisco IOS XR software retransmits a packet to a server before giving up, use the radius-server retransmit command in global configuration mode. To disable retransmission, use the no form of this command.

radius-server retransmit retries

no radius-server retransmit

Syntax Description

retries

Maximum number of retransmission attempts. The range is from 1 to 100. Default is 3.

Defaults

The RADIUS servers are retried three times, or until a response is received.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The RADIUS client tries all servers, allowing each one to time out before increasing the retransmit count.

Examples

The following example shows how to specify a retransmit counter value of five times:

RP/0/RP0/CPU0:router# configure 

RP/0/RP0/CPU0:router(config)# radius-server retransmit 5 

radius-server timeout

To set the interval for which a router waits for a server host to reply before timing out, use the radius-server timeout command in global configuration mode. To restore the default, use the no form of this command.

radius-server timeout seconds

no radius-server timeout

Syntax Description

seconds

Number that specifies the timeout interval, in seconds. Range is from 1 to 1000.

Defaults

seconds: 5 seconds

Command Modes

Global configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the radius-server timeout command to set the number of seconds a router waits for a server host to reply before timing out.

Examples

The following example shows how to change the interval timer to 10 seconds:

RP/0/RP0/CPU0:router# configure 

RP/0/RP0/CPU0:router(config)# radius-server timeout 10 

Related Commands

Command	Description
radius-server host	Specifies a RADIUS server host.
radius-server key	Sets the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon.

radius source-interface

To force RADIUS to use the IP address of a specified interface or subinterface for all outgoing RADIUS packets, use the radius source-interface command in global configuration mode. To prevent RADIUS from using the IP address of a specified interface or subinterface for all outgoing RADIUS packets, use the no form of this command.

radius source-interface interface-name

no radius source-interface

Syntax Description

interface-name

Name of the interface that RADIUS uses for all of its outgoing packets.

Defaults

If a specific source interface is not configured, or the interface is down or does not have an IP address configured, the system selects an IP address.

Command Modes

Global configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the radius source-interface command to set the IP address of the specified interface or subinterface for all outgoing RADIUS packets. This address is used as long as the interface or subinterface is in the up state. In this way, the RADIUS server can use one IP address entry for every network access client instead of maintaining a list of IP addresses.

The specified interface or subinterface must have an IP address associated with it. If the specified interface or subinterface does not have an IP address or is in the down state, then RADIUS reverts to the default. To avoid this, add an IP address to the interface or subinterface or bring the interface to the up state.

This command is especially useful in cases where the router has many interfaces or subinterfaces and you want to ensure that all RADIUS packets from a particular router have the same IP address.

Examples

The following example shows how to make RADIUS use the IP address of subinterface s2 for all outgoing RADIUS packets:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# radius source-interface s2

secret

To create a secure login password for a user, use the secret command in username or line configuration mode. To remove the secure password, use the no form of this command.

secret {0 | 5} password

no secret {0 | 5} password

Syntax Description

0	Specifies that an unencrypted (clear text) secure password follows.
5	Specifies that one-way hash of the text follows.
password	Character-string password to be entered by the user to log in.

Defaults

No password is specified.

Command Modes

Username configuration
Line configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

You can specify one of two types of secure passwords: encrypted or clear text.

When an EXEC process is started on a line that has password protection, the process prompts for the password. If the user enters the correct password, the process issues the prompt. The user can try three times to enter a password before the process exits and returns the terminal to the idle state.

Secrets are one-way encrypted and should be used for applications such as login that do not need a decryptable secret.

Examples

The following example shows how to establish the secure encrypted password pwd2 for the user user2:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# username user2

RP/0/RP0/CPU0:router(config-un)# secret 5 pwd2

Related Commands

Command	Description
group	Adds a user to a group.
password (AAA)	Creates a login password for a user.
usergroup	Accesses user group configuration mode and configures a user group, associating it with a set of task groups.
username	Accesses username configuration mode and configures a new user with a username, establishing a password and granting permissions for that user.

server (RADIUS)

To associate a particular RADIUS server with a defined server group, use the server command in server-group configuration mode. To remove the associated server from the server group, use the no form of this command.

server {hostname | ip-address} [auth-port port-number] [acct-port port-number]

no server {hostname | ip-address}

Syntax Description

hostname	Character string used to name the server host.
ip-address	IP address of the RADIUS server host.
auth-port port-number	(Optional) Specifies the User Datagram Protocol (UDP) destination port for authentication requests. The port-number argument specifies the port number for authentication requests. The host is not used for authentication if this value is set to 0. Default is 1645.
acct-port port-number	(Optional) Specifies the UDP destination port for accounting requests. The port-number argument specifies the port number for accounting requests. The host is not used for accounting services if this value is set to 0. Default is 1646.

Defaults

If no port attributes are defined, the defaults are as follows:

•Authentication port: 1645

•Accounting port: 1646

Command Modes

Server-group configuration

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the server command to associate a particular RADIUS server with a defined server group.

There are two different ways in which you can identify a server, depending on the way you want to offer AAA services. You can identify the server simply by using its IP address, or you can identify multiple host instances or entries using the optional auth-port and acct-port keywords.

When you use the optional keywords, the network access server identifies RADIUS security servers and host instances associated with a group server based on their IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS host entries providing a specific AAA service. If two different host entries on the same RADIUS server are configured for the same service, for example, accounting, the second host entry configured acts as failover backup to the first one. Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry configured on the same device for accounting services. (The RADIUS host entries are tried in the order they are configured.)

Examples

The following example shows the network access server configured to recognize several RADIUS host entries with the same IP address. Two different host entries on the same RADIUS server are configured for the same services—authentication and accounting. The second host entry configured acts as fail-over backup to the first one.

! This command configures default RADIUS parameters.

aaa authentication ppp default group radius 

! The next set of commands configures multiple host entries for the same IP address.

radius-server host 172.20.0.1 auth-port 1000 acct-port 1001

radius-server host 172.20.0.1 auth-port 2000 acct-port 2001

Related Commands

Command	Description
aaa group server radius	Groups different RADIUS server hosts into distinct lists and distinct methods.
radius-server host	Specifies a RADIUS server host.

server (TACACS+)

To associate a particular TACACS+ server with a defined server group, use the server command in TACACS+ server-group configuration mode. To remove the associated server from the server group, use the no form of this command.

server {hostname | ip-address}

no server {hostname | ip-address}

Syntax Description

hostname	Character string used to name the server host.
ip-address	IP address of the server host.

Defaults

No default behavior or values

Command Modes

Server-group configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the server command to associate a particular TACACS+ server with a defined server group. The server need not be accessible during configuration. Later, you can reference the configured server group from the method lists used to configure authentication, authorization, and accounting (AAA).

Examples

The following example shows how to associate the TACACS+ server with the IP address 192.168.60.15 with the server group tac1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa group server tacacs+ tac1

RP/0/RP0/CPU0:router(config-sg-tacacs+)# server 192.168.60.15

Related Commands

Command	Description
aaa group server tacacs+	Groups different TACACS+ server hosts into distinct lists.

show aaa

To display information about a user group, local user, or task group; to list all task IDs associated with all user groups, local users, or task groups in the system; or to list all task IDs for a specified user group, local user, or task group, use the show aaa command in EXEC mode.

show aaa {usergroup [usergroup-name] | userdb [username] | taskgroup [taskgroup-name]}

Syntax Description

usergroup	Displays details for all user groups.
usergroup-name	(Optional) User group whose details are to be displayed.
userdb	Displays details for all local users and the usergroups to which each user belongs.
username	(Optional) User whose details are to be displayed.
taskgroup	Displays details for all task groups.
taskgroup-name	(Optional) Task group whose details are to be displayed.

Defaults

Details for all user groups, or all local users, or all task groups are listed if no argument is entered.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show aaa command to list details for all user groups, local users, or task groups in the system. Use the optional usergroup-name, username, or taskgroup-name argument to display the details for a specified user group, user, or task group, respectively.

Examples

The following sample output is from the show aaa usergroup command:

RP/0/RP0/CPU0:router# show aaa usergroup operator

User group 'operator'

  Inherits from task group 'operator'

User group 'operator' has the following combined set

of task IDs (including all inherited groups):

Task:       basic-services  : READ    WRITE    EXECUTE 	DEBUG

Task:                  cdp  : READ

Task:                 diag  : READ

Task:           ext-access  : READ             EXECUTE

Task:              logging  : READ

The following sample output is from the show aaa taskgroup command:

RP/0/RP0/CPU0:router# show aaa taskgroup netadmin

Task group 'netadmin'

Task group 'netadmin' has the following combined set

  of task IDs (including all inherited groups):

Task:                  aaa  : READ                              

Task:                  acl  : READ    WRITE    EXECUTE    DEBUG

Task:                admin  : READ                              

Task:                  atm  : READ    WRITE    EXECUTE    DEBUG

Task:       basic-services  : READ    WRITE    EXECUTE    DEBUG

Task:                 bcdl  : READ                              

Task:                  bfd  : READ    WRITE    EXECUTE    DEBUG

Task:                  bgp  : READ    WRITE    EXECUTE    DEBUG

Task:                 boot  : READ    WRITE    EXECUTE    DEBUG

Task:               bundle  : READ    WRITE    EXECUTE    DEBUG

Task:                  cdp  : READ    WRITE    EXECUTE    DEBUG

Task:                  cef  : READ    WRITE    EXECUTE    DEBUG

Task:        cisco-support  : READ                              

Task:          config-mgmt  : READ    WRITE    EXECUTE    DEBUG

Task:      config-services  : READ    WRITE    EXECUTE    DEBUG

Task:               crypto  : READ    WRITE    EXECUTE    DEBUG

Task:                 diag  : READ    WRITE    EXECUTE    DEBUG

Task:           disallowed  : READ                              

Task:              drivers  : READ                              

Task:           ext-access  : READ    WRITE    EXECUTE    DEBUG

Task:               fabric  : READ    WRITE    EXECUTE    DEBUG

Task:            fault-mgr  : READ    WRITE    EXECUTE    DEBUG

Task:           filesystem  : READ    WRITE    EXECUTE    DEBUG

Task:                   fr  : READ    WRITE    EXECUTE    DEBUG

Task:                 hdlc  : READ    WRITE    EXECUTE    DEBUG

Task:        host-services  : READ    WRITE    EXECUTE    DEBUG

Task:                 hsrp  : READ    WRITE    EXECUTE    DEBUG

Task:            interface  : READ    WRITE    EXECUTE    DEBUG

Task:            inventory  : READ                              

Task:          ip-services  : READ    WRITE    EXECUTE    DEBUG

Task:                 ipv4  : READ    WRITE    EXECUTE    DEBUG

Task:                 ipv6  : READ    WRITE    EXECUTE    DEBUG

Task:                 isis  : READ    WRITE    EXECUTE    DEBUG

Task:              logging  : READ    WRITE    EXECUTE    DEBUG

Task:                 lpts  : READ    WRITE    EXECUTE    DEBUG

Task:              monitor  : READ                              

Task:             mpls-ldp  : READ    WRITE    EXECUTE    DEBUG

Task:          mpls-static  : READ    WRITE    EXECUTE    DEBUG

Task:              mpls-te  : READ    WRITE    EXECUTE    DEBUG

Task:            multicast  : READ    WRITE    EXECUTE    DEBUG

Task:              netflow  : READ    WRITE    EXECUTE    DEBUG

Task:              network  : READ    WRITE    EXECUTE    DEBUG

Task:                 ospf  : READ    WRITE    EXECUTE    DEBUG

Task:                 ouni  : READ    WRITE    EXECUTE    DEBUG

Task:             pkg-mgmt  : READ                              

Task:              pos-dpt  : READ    WRITE    EXECUTE    DEBUG

Task:                  ppp  : READ    WRITE    EXECUTE    DEBUG

Task:                  qos  : READ    WRITE    EXECUTE    DEBUG

Task:                  rib  : READ    WRITE    EXECUTE    DEBUG

Task:                  rip  : READ    WRITE    EXECUTE    DEBUG

Task:              root-lr  : READ                              

Task:            route-map  : READ    WRITE    EXECUTE    DEBUG

Task:         route-policy  : READ    WRITE    EXECUTE    DEBUG

Task:                 snmp  : READ    WRITE    EXECUTE    DEBUG

Task:            sonet-sdh  : READ    WRITE    EXECUTE    DEBUG

Task:               static  : READ    WRITE    EXECUTE    DEBUG

Task:               sysmgr  : READ                              

Task:               system  : READ    WRITE    EXECUTE    DEBUG

Task:            transport  : READ    WRITE    EXECUTE    DEBUG

Task:           tty-access  : READ    WRITE    EXECUTE    DEBUG

Task:               tunnel  : READ    WRITE    EXECUTE    DEBUG

Task:            universal  : READ                              

Task:                 vlan  : READ    WRITE    EXECUTE    DEBUG

Task:                 vrrp  : READ    WRITE    EXECUTE    DEBUG

The following sample output is from the show aaa taskgroup operator command. The task group operator has the following combined set of task IDs, which includes all inherited groups:

Task:       basic-services  : READ    WRITE    EXECUTE    DEBUG

Task:                  cdp  : READ                              

Task:                 diag  : READ                              

Task:           ext-access  : READ             EXECUTE          

Task:              logging  : READ 

The following sample output is from the show aaa taskgroup root-system command. The task group root-system has the following combined set of task IDs, which includes all inherited groups:

Task:                  aaa  : READ    WRITE    EXECUTE    DEBUG

Task:                  acl  : READ    WRITE    EXECUTE    DEBUG

Task:                admin  : READ    WRITE    EXECUTE    DEBUG

Task:                  atm  : READ    WRITE    EXECUTE    DEBUG

Task:       basic-services  : READ    WRITE    EXECUTE    DEBUG

Task:                 bcdl  : READ    WRITE    EXECUTE    DEBUG

Task:                  bfd  : READ    WRITE    EXECUTE    DEBUG

Task:                  bgp  : READ    WRITE    EXECUTE    DEBUG

Task:                 boot  : READ    WRITE    EXECUTE    DEBUG

Task:               bundle  : READ    WRITE    EXECUTE    DEBUG

Task:                  cdp  : READ    WRITE    EXECUTE    DEBUG

Task:                  cef  : READ    WRITE    EXECUTE    DEBUG

Task:          config-mgmt  : READ    WRITE    EXECUTE    DEBUG

Task:      config-services  : READ    WRITE    EXECUTE    DEBUG

Task:               crypto  : READ    WRITE    EXECUTE    DEBUG

Task:                 diag  : READ    WRITE    EXECUTE    DEBUG

Task:              drivers  : READ    WRITE    EXECUTE    DEBUG

Task:           ext-access  : READ    WRITE    EXECUTE    DEBUG

Task:               fabric  : READ    WRITE    EXECUTE    DEBUG

Task:            fault-mgr  : READ    WRITE    EXECUTE    DEBUG

Task:           filesystem  : READ    WRITE    EXECUTE    DEBUG

Task:                   fr  : READ    WRITE    EXECUTE    DEBUG

Task:                 hdlc  : READ    WRITE    EXECUTE    DEBUG

Task:        host-services  : READ    WRITE    EXECUTE    DEBUG

Task:                 hsrp  : READ    WRITE    EXECUTE    DEBUG

Task:            interface  : READ    WRITE    EXECUTE    DEBUG

Task:            inventory  : READ    WRITE    EXECUTE    DEBUG

Task:          ip-services  : READ    WRITE    EXECUTE    DEBUG

Task:                 ipv4  : READ    WRITE    EXECUTE    DEBUG

Task:                 ipv6  : READ    WRITE    EXECUTE    DEBUG

Task:                 isis  : READ    WRITE    EXECUTE    DEBUG

Task:              logging  : READ    WRITE    EXECUTE    DEBUG

Task:                 lpts  : READ    WRITE    EXECUTE    DEBUG

Task:              monitor  : READ    WRITE    EXECUTE    DEBUG

Task:             mpls-ldp  : READ    WRITE    EXECUTE    DEBUG

Task:          mpls-static  : READ    WRITE    EXECUTE    DEBUG

Task:              mpls-te  : READ    WRITE    EXECUTE    DEBUG

Task:            multicast  : READ    WRITE    EXECUTE    DEBUG

Task:              netflow  : READ    WRITE    EXECUTE    DEBUG

Task:              network  : READ    WRITE    EXECUTE    DEBUG

Task:                 ospf  : READ    WRITE    EXECUTE    DEBUG

Task:                 ouni  : READ    WRITE    EXECUTE    DEBUG

Task:             pkg-mgmt  : READ    WRITE    EXECUTE    DEBUG

Task:              pos-dpt  : READ    WRITE    EXECUTE    DEBUG

Task:                  ppp  : READ    WRITE    EXECUTE    DEBUG

Task:                  qos  : READ    WRITE    EXECUTE    DEBUG

Task:                  rib  : READ    WRITE    EXECUTE    DEBUG

Task:                  rip  : READ    WRITE    EXECUTE    DEBUG

Task:              root-lr  : READ    WRITE    EXECUTE    DEBUG

Task:          root-system  : READ    WRITE    EXECUTE    DEBUG

Task:            route-map  : READ    WRITE    EXECUTE    DEBUG

Task:         route-policy  : READ    WRITE    EXECUTE    DEBUG

Task:                 snmp  : READ    WRITE    EXECUTE    DEBUG

Task:            sonet-sdh  : READ    WRITE    EXECUTE    DEBUG

Task:               static  : READ    WRITE    EXECUTE    DEBUG

Task:               sysmgr  : READ    WRITE    EXECUTE    DEBUG

Task:               system  : READ    WRITE    EXECUTE    DEBUG

Task:            transport  : READ    WRITE    EXECUTE    DEBUG

Task:           tty-access  : READ    WRITE    EXECUTE    DEBUG

Task:               tunnel  : READ    WRITE    EXECUTE    DEBUG

Task:            universal  : READ    WRITE    EXECUTE    DEBUG

Task:                 vlan  : READ    WRITE    EXECUTE    DEBUG

Task:                 vrrp  : READ    WRITE    EXECUTE    DEBUG

The following sample is output from the show aaa userdb command:

RP/0/RP0/CPU0:router# show aaa userdb

Username lab (admin plane)

	User group root-system

	User group cisco-support

Username acme

	User group root-system

Related Commands

Command	Description
show user	Displays task IDs enabled for the currently logged-in user.

show radius

To display information about the RADIUS servers that are configured in the system, use the show radius command in EXEC mode.

show radius

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show radius command to display statistics for each configured RADIUS server.

Examples

The following sample output is for the show radius command:

RP/0/RP0/CPU0:router# show radius

Server:12.26.49.12/10000/10001

  Timeout:5, Retransmit limit:3

  5 requests sent, 5 responses received, 0 requests timed-out

Server:1.1.1.1/10000/10001

  Timeout:5, Retransmit limit:3

  0 requests sent, 0 responses received, 0 requests timed-out

Table 2 describes the significant fields shown in the display.

Table 2 show radius Field Descriptions 

Field	Description
Server	Server IP address/UDP destination port for authentication requests/UDP destination port for accounting requests.
Timeout	Number of seconds the router waits for a server host to reply before timing out.
Retransmit limit	Number of times the Cisco IOS XR software searches the list of RADIUS server hosts before giving up.

Related Commands

Command	Description
radius-server host	Specifies a RADIUS server host.
radius-server retransmit	Specifies how many times the Cisco IOS software searches the list of RADIUS server hosts before giving up.
radius-server timeout	Sets the interval for which a router waits for a server host to reply.

show radius server-groups

To display information about the RADIUS server groups that are configured in the system, use the show radius server-groups command in EXEC mode.

show radius server-groups

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show radius server-groups command to display information about each configured RADIUS server group, including the group name, numbers of servers in the group, and a list of servers in the named server group. A global list of all configured RADIUS servers, along with authentication and accounting port numbers, is also displayed.

Examples

The following sample is output for the show radius server-groups command:

RP/0/RP0/CPU0:router# show radius server-groups

Global list of servers 
	Server 4.4.4.4/1812/1813 
	Server 12.26.37.2/1812/1813 
	Server 6.6.6.6/8000/5000 
	Server 7.7.8.8/4532/1813 
	Server 9.9.9.9/1812/5000

Server group `rad100' has 3 servers 
	Server 7.7.8.8/4532/1813 
	Server 9.9.9.9/1812/5000

	Server 6.6.6.6/8000/5000

Table 3 describes the significant fields shown in the display.

Table 3 show radius server-groups Field Descriptions 

Field	Description
Server	Server IP address/UDP destination port for authentication requests/UDP destination port for accounting requests.

Related Commands

Command	Description
radius-server host	Specifies a RADIUS server host.

show tacacs

To display information about the TACACS+ servers that are configured in the system, use the show tacacs command in EXEC mode.

show tacacs

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show tacacs command to display statistics for each configured TACACS+ server.

Examples

The following sample output is from the show tacacs command:

RP/0/RP0/CPU0:router# show tacacs

Server:1.1.1.1/21212 opens=0 closes=0 aborts=0 errors=0

        packets in=0 packets out=0

        status=up single-connect=false

Server:2.2.2.2/21232 opens=0 closes=0 aborts=0 errors=0

        packets in=0 packets out=0

        status=up single-connect=false

Table 4 describes the significant fields shown in the display.

Table 4 show tacacs Field Descriptions 

Field	Description
Server	Server IP address.
opens	Number of socket opens to the external server.
closes	Number of socket closes to the external server.
aborts	Number of tacacs requests that have been aborted midway.
errors	Number of error replies from the external server.
packets in	Number of TCP packets that have been received from the external server.
packets out	Number of TCP packets that have been sent to the external server.

show tacacs server-groups

To display information about the TACACS+ server groups that are configured in the system, use the show tacacs server-groups command in EXEC mode.

show tacacs server-groups

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 3.2	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show tacacs server-groups command to display information about each configured TACACS+ server group, including the group name, numbers of servers in the group, and a list of servers in the named server group. A global list of all configured TACACS+ servers is also displayed.

Examples

The following sample output is from the show tacacs server-groups command:

RP/0/RP0/CPU0:router# show tacacs server-groups

Global list of servers

  Server 12.26.25.61/23456

  Server 12.26.49.12/12345

  Server 12.26.49.12/9000

  Server 12.26.25.61/23432

  Server 5.5.5.5/23456

  Server 1.1.1.1/49

Server group `tac100' has 1 servers 
	Server 12.26.49.12

Table 5 describes the significant fields shown in the display.

Table 5 show tacacs server-groups Field Descriptions 

Field	Description
Server	Server IP address.

Related Commands

Command	Description
tacacs-server host	Specifies a TACACS+ server host.

show task supported

To display all task IDs available in the system, use the show task supported command in EXEC mode.

show task supported

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show task supported command to display all task IDs available in the system.

Examples

The following sample output is from the show task supported command. Task IDs are displayed in alphabetical order.

RP/0/RP0/CPU0:router# show task supported

aaa

acl

admin

atm

basic-services

bcdl

bfd

bgp

boot

bundle

cdp

cef

cisco-support

config-mgmt

config-services

crypto

diag

disallowed

drivers

ext-access

fabric

fault-mgr

filesystem

fr

hdlc

host-services

hsrp

interface

inventory

ip-services

ipv4

ipv6

isis

logging

lpts

monitor

mpls-ldp

mpls-static

mpls-te

multicast

netflow

network

ospf

ouni

pkg-mgmt

pos-dpt

ppp

qos

rib

rip

root-lr

root-system

route-map

route-policy

snmp

sonet-sdh

static

sysmgr

system

transport

tty-access

tunnel

universal

vlan

vrrp

Related Commands

Command	Description
show aaa taskgroup	Lists all task groups or the specified group and the corresponding task map.
show aaa usergroup	Lists all user groups or the specified group.
show user task	Displays task IDs enabled for the currently logged-in user.

show user

To display all user groups and task IDs associated with the currently logged-in user, use the show user command in EXEC mode.

show user [group | tasks | all]

Syntax Description

group	(Optional) Displays the user groups associated with the currently logged-in user.
tasks	(Optional) Displays task IDs associated with the currently logged-in user.
all	(Optional) Displays all user groups and task IDs for the currently logged-in user.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show user command to display all user groups and task IDs associated with the currently logged-in user.

Examples

The following sample output is from the show user tasks command:

RP/0/RP0/CPU0:router# show user tasks

Task:       basic-services  : READ    WRITE    EXECUTE    DEBUG

Task:                  cdp  : READ                              

Task:                 diag  : READ                              

Task:           ext-access  : READ             EXECUTE          

Task:              logging  : READ                              

Related Commands

Command	Description
show aaa	Displays the task maps for selected user groups, local users, or task groups.
show task supported	Displays all task IDs defined in the system.

tacacs-server host

To specify a TACACS+ host server, use the tacacs-server host command in global configuration mode. To delete the specified name or address, use the no form of this command.

tacacs-server host host-name [port port-number] [timeout seconds] [key [0 | 7] auth-key]

no tacacs-server host host-name [port port-number]

Syntax Description

host-name	Name or IP address of the TACACS+ server.
port port-number	(Optional) Specifies a server port number. This option overrides the default, which is port 49. Valid port numbers range from 1 to 65535.
timeout seconds	(Optional) Specifies a timeout value that sets the length of time the authentication, authorization, and accounting (AAA) server waits to receive a response from the TACACS+ server. This option overrides the global timeout value set with the tacacs-server timeout command for this server only. The valid timeout range is from 1 to 1000 seconds. Default is 5.
key [0 | 7] auth-key	(Optional) Specifies an authentication and encryption key shared between the AAA server and the TACACS+ server. The TACACS+ packets are encrypted using this key. This key must match the key used by the TACACS+ daemon. Specifying this key overrides the key set by the tacacs-server key command for this server only. (Optional) Entering 0 specifies that an unencrypted (clear-text) key follows. (Optional) Entering 7 specifies that an encrypted key follows. The auth-key argument specifies the unencrypted key to be used between the AAA server and the TACACS+ server.

Defaults

No TACACS+ host is specified.
The port, if not specified, defaults to the standard port 49.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The key keyword must be entered last because it uses a line (text with breaks) rather than a string (text only, with no breaks). Any text and line breaks up to the time the user presses Enter can be used as part of the key.

You can use multiple tacacs-server host commands to specify additional hosts. The Cisco IOS XR software searches for hosts in the order in which you specify them.

Examples

The following example shows how to specify a TACACS+ host with the IP address 209.165.200.226:

RP/0/RP0/CPU0:router(config)# tacacs-server host 209.165.200.226

The following example shows how to specify that the router consult the TACACS+ server host named host1 on port number 51. The timeout value for requests on this connection is 30 seconds; the encryption key is a_secret.

RP/0/RP0/CPU0:router(config)# tacacs-server host host1 port 51 timeout 30 key a_secret

Related Commands

Command	Description
tacacs-server key	Globally sets the authentication encryption key used for all TACACS+ communications between the router and the TACACS+ daemon.
tacacs-server timeout	Globally sets the interval that the router waits for a server host to reply.

tacacs-server key

To set the authentication encryption key used for all TACACS+ communications between the HF and the TACACS+ daemon, use the tacacs-server key command in global configuration mode. To disable the key, use the no form of this command.

tacacs-server key key-name

no tacacs-server key

Syntax Description

key-name

Name of the key used to set authentication and encryption. This key name must match the key used on the TACACS+ daemon. This key name applies to all servers that have no individual keys specified.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The key name entered must match the key used on the TACACS+ daemon. All leading spaces are ignored; spaces within and after the key are not. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.

The TACACS server key is used only if no key is configured for an individual TACACS server. Keys configured for an individual TACACS server always override this global key configuration.

Examples

The following example sets the authentication and encryption key to key1:

RP/0/RP0/CPU0:router(config)# tacacs-server key key1

Related Commands

Command	Description
tacacs-server host	Specifies a TACACS+ host.

tacacs-server timeout

To set the interval that the server waits for a server host to reply, use the tacacs-server timeout command in global configuration mode. To restore the default, use the no form of this command.

tacacs-server timeout seconds

no tacacs-server timeout

Syntax Description

seconds

Integer that specifies the timeout interval (in seconds) from 1 to 1000.

Defaults

seconds: 5 seconds

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the tacacs-server timeout command to set the interval that the server waits for a server host to reply.

The TACACS+ server timeout is used only if no timeout is configured for an individual TACACS+ server. Timeout intervals configured for an individual TACACS+ server always override this global timeout configuration.

Examples

The following example shows the interval timer being changed to 10 seconds:

RP/0/RP0/CPU0:router(config)# tacacs-server timeout 10 

Related Commands

Command	Description
tacacs-server host	Specifies a TACACS+ host.

tacacs source-interface

To specify the source IP address of a selected interface for all outgoing TACACS+ packets, use the tacacs source-interface command in global configuration mode. To disable use of the specified interface IP address, use the no form of this command.

tacacs source-interface type instance

no tacacs source-interface type instance

Syntax Description

type

Interface type. For more information, use the question mark (?) online help function.

instance

Either a physical interface instance or a virtual interface instance as follows: •Physical interface instance. Naming notation is rack/slot/module/port and a slash between values is required as part of the notation. –rack: Chassis number of the rack. –slot: Physical slot number of the modular services card or line card. –module: Module number. A physical layer interface module (PLIM) is always 0. –port: Physical port number of the interface. Note In references to a Management Ethernet interface located on a route processor card, the physical slot number is alphanumeric (RP0 or RP1) and the module is CPU0. Example: interface MgmtEth0/RP1/CPU0/0. •Virtual interface instance. Number range varies depending on interface type. For more information about the syntax for the router, use the question mark (?) online help function.

Defaults

If a specific source interface is not configured, or the interface is down or does not have an IP address configured, the system selects an IP address.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the tacacs source-interface command to set the IP address of the specified interface for all outgoing TACACS+ packets. This address is used as long as the interface is in the up state. In this way, the TACACS+ server can use one IP address entry associated with the network access client instead of maintaining a list of all IP addresses.

This command is especially useful in cases where the router has many interfaces and you want to ensure that all TACACS+ packets from a particular router have the same IP address.

When the specified interface does not have an IP address or is in a down state, TACACS+ behaves as if no source interface configuration is used.

Examples

The following example shows how to set the IP address of the specified POS interface for all outgoing TACACS+ packets:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# tacacs source-interface POS 0/1/0/1

Related Commands

Command	Description
aaa group server radius	Groups different server hosts into distinct lists and distinct methods.

task

To add a task ID to a task group, use the task command in task group configuration mode. To remove a task ID from a task group, use the no form of this command.

task {read | write | execute | debug} taskid-name

no task {read | write | execute | debug} taskid-name

Syntax Description

read	Enables read-only privileges for the named task ID.
write	Enables write privileges for the named task ID. The term "write" implies read also.
execute	Enables execute privileges for the named task ID.
debug	Enables debug privileges for the named task ID.
taskid-name	Name of the task ID.

Defaults

No task IDs are assigned to a newly created task group.

Command Modes

Task group configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the task command in task group configuration mode. To access task group configuration mode, use the taskgroup command in global configuration mode.

Examples

The following example shows how to enable execute privileges for the config-services task ID and associate that task ID with the task group named taskgroup1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# taskgroup taskgroup1

RP/0/RP0/CPU0:router(config-tg)# task execute config-services

Related Commands

Command	Description
taskgroup	Configures a task group to be associated with a set of task IDs.

taskgroup

To configure a task group to be associated with a set of task IDs, and to enter task group configuration mode, use the taskgroup command in global configuration mode. To delete a task group, use the no form of this command.

taskgroup taskgroup-name [description string | task {read | write | execute | debug}
taskid-name | inherit taskgroup taskgroup-name]

no taskgroup taskgroup-name

Syntax Description

taskgroup-name	Name of a particular task group.
description	(Optional) Enables you to create a description for the named task group.
string	(Optional) Character string used for the task group description.
task	(Optional) Specifies that a task ID is to be associated with the named task group.
read	(Optional) Specifies that the named task ID permits read access only.
write	(Optional) Specifies that the named task ID permits read and write access only.
execute	(Optional) Specifies that the named task ID permits execute access.
debug	(Optional) Specifies that the named task ID permits debug access only.
taskid-name	(Optional) Name of a task: the task ID.
inherit taskgroup	(Optional) Copies permissions from the named task group.
taskgroup-name	(Optional) Name of the task group from which permissions are to be inherited.

Defaults

Five predefined user groups are available by default.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Task groups are configured with a set of task IDs for each action type. Deleting a task group that is still referenced in the system results in a warning and rejection of the deletion.

Entering the taskgroup command with no keywords or arguments enters task group configuration mode, where you can use the description, inherit, show, and task commands.

Examples

The following example assigns read bgp permission to the task group named alpha:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# taskgroup alpha

RP/0/RP0/CPU0:router(config-tg)# task read bgp

Related Commands

Command	Description
description (AAA)	Creates a task group description in task configuration mode.
task	Adds a task ID to a task group.

timeout login response

To set the interval that the server waits for a reply to a login, use the timeout login response command in line configuration mode. To restore the default, use the no form of this command.

timeout login response seconds

no timeout login response seconds

Syntax Description

seconds

Integer that specifies the timeout interval (in seconds) from 0 to 300.

Defaults

seconds: 30 seconds

Command Modes

Line configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the timeout login response command in line configuration mode to set the timeout value. This timeout value applies to all terminal lines to which the entered line template is applied. This timeout value can also be applied to line console. After the timeout value has expired, the user is prompted again. The retry is allowed three times.

Examples

The following example shows how to change the interval timer to 20 seconds:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# line template alpha

RP/0/RP0/CPU0:router(config-line)# timeout login response 20

Related Commands

Command	Description
login authentication	Enables AAA authentication for logins.

usergroup

To configure a user group and associate it with a set of task groups, and to enter user group configuration mode, use the usergroup command in global configuration mode. To delete a user group, or to delete a task-group association with the specified user group, use the no form of this command.

usergroup usergroup-name [description string | taskgroup taskgroup-name | inherit usergroup usergroup-name]

no usergroup usergroup-name [description string | taskgroup taskgroup-name | inherit usergroup usergroup-name]

Syntax Description

usergroup-name	Name of the user group. The usergroup-name argument can be only one word. Spaces and quotation marks are not allowed.
description string	(Optional) Describes the user group.
taskgroup taskgroup-name	(Optional) Associates the specified task group with the named user group and inherits the task group permissions into this user group.
inherit usergroup usergroup-name	(Optional) Copies permissions from another user group.

Defaults

Five predefined user groups are available by default.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

User groups are configured with the command parameters for a set of users, such as task groups. You can remove specific user groups by using the no form of the usergroup command. You can remove the user group itself by using the no form of the command without giving any parameters. Deleting a user group that is still referenced in the system results in a warning and a rejection of the deletion.

Use the inherit usergroup command to copy permissions from other user groups. The user group is inherited by the parent group and forms a union of all task IDs specified in those groups. Cyclic inclusions are detected and rejected. User groups cannot inherit properties from predefined groups, such as root-system and owner-lr.

Examples

The following example shows how to add permissions from the user group beta to the user group alpha:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# usergroup alpha

RP/0/RP0/CPU0:router(config-u)# inherit usergroup beta

Related Commands

Command	Description
description (AAA)	Creates a description of a task group during configuration.
inherit usergroup	Enables a user group to derive permissions from another user group.
taskgroup	Configures a task group to be associated with a set of task IDs.

username

To configure a new user with a username, establish a password, and grant permissions for the user, and to enter username configuration mode, use the username command in global configuration mode. To delete a user from the database, use the no form of this command.

username user-name [password {0 | 7} password | secret {5} password | group usergroup-name]

no username user-name [password {0 | 7} password | secret {5} password | group usergroup-name]

Syntax Description

user-name	Name of the user. The user-name argument can be only one word. Spaces and quotation marks are not allowed.
password	(Optional) Enables a password to be created for the named user.
0	(Optional) Specifies that an unencrypted (clear-text) password follows.
7	(Optional) Specifies that an encrypted password follows.
password	(Optional) Specifies the character-string password to be entered by the user to log in.
secret	(Optional) Enables a secure password to be created for the named user.
5	(Optional) Specifies an encrypted password follows.
group	(Optional) Enables a named user to be associated with a user group.
usergroup-name	(Optional) Name of a user group as defined with the usergroup command.

Defaults

No usernames are defined in the system.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the username command to identify the user and enter username configuration mode. Password and user group assignments can be made from either global configuration mode or username configuration submode. Permissions (task IDs) are assigned by associating the user with one or more defined user groups.

Each user is identified by a username that is unique across the administrative domain. Each user should be made a member of at least one user group. Deleting a user group may orphan the users associated with that group. The AAA server authenticates orphaned users but most commands are not authorized.

If you want to require a username and password on the console or for Telnet sessions, configure authentication using both the aaa authentication login default local command and the username command.

The predefined group root-system may be specified only by root-system users while administration is configured.

---

Note To enable the local networking device to respond to remote CHAP challenges, one username command entry must be the same as the hostname entry that has already been assigned to the other networking device.

---

Examples

The following example shows how to establish the unencrypted password password1 for the user user1:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# username user1

RP/0/RP0/CPU0:router(config-un)# password 0 password1

Related Commands

Command	Description
aaa authentication	Defines a method list for authentication.
group	Adds a user to a group.
password (AAA)	Creates a login password for a user.

users group

To associate a user group and its privileges with a line, use the users group command in line configuration mode. To delete a user group association with a line, use the no form of this command.

users group {usergroup-name | cisco-support | netadmin | operator | root-lr | root-system | sysadmin}

no users group {usergroup-name | cisco-support | netadmin | operator | root-lr | root-system | sysadmin}

Syntax Description

usergroup-name	Name of the user group. The usergroup-name argument can be only one word. Spaces and quotation marks are not allowed.
cisco-support	Specifies that users logging in through the line are given Cisco support personnel privileges.
netadmin	Specifies that users logging in through the line are given network administrator privileges.
operator	Specifies that users logging in through the line are given operator privileges.
root-lr	Specifies that users logging in through the line are given root logical router (LR) privileges.
root-system	Specifies that users logging in through the line are given root system privileges.
sysadmin	Specifies that users logging in through the line are given system administrator privileges.

Defaults

No default behavior or values

Command Modes

Line configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the users group command to enable a user group and its privileges to be associated with a line, meaning that users logging in through the line are given the privileges of the particular user group.

Examples

In the following example, if a vty-pool is created with line template vty, users logging in through vty are given operator privileges:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# aaa authen login vty-authen line

RP/0/RP0/CPU0:router(config)# commit

RP/0/RP0/CPU0:router(config)# line template vty

RP/0/RP0/CPU0:router(config-line)# users group operator

RP/0/RP0/CPU0:router(config-line)# login authentication vty-authen