Table Of Contents

TACACS+ Attribute-Value Pairs

Cisco IOS AV Pair Dictionary

TACACS+ AV Pairs

TACACS+ Accounting AV Pairs

TACACS+ Attribute-Value Pairs

---

The Cisco Secure Access Control Server Release 4.1, hereafter referred to as ACS, supports Terminal Access Controller Access Control System (TACACS+) attribute-value (AV) pairs. You can enable different AV pairs for any supported attribute value.

Cisco IOS AV Pair Dictionary

To use the full range of the Cisco IOS AV-pair dictionary for TACACS+, the AAA client should use IOS version 11.3 or later. Cisco IOS 11.1 and 11.2 have only partial support for TACACS+ AV-pairs.

---

Note If you specify a given AV pair in ACS, you must also enable the corresponding AV pair in the Cisco IOS software that is running on the AAA client. Therefore, you must consider which AV pairs your Cisco IOS release supports. If ACS sends an AV pair to the AAA client that the Cisco IOS software does not support, that attribute is not implemented.

---

For more information on TACACS+ AV pairs, refer to Cisco IOS documentation for the release of Cisco IOS that is running on your AAA clients.

---

Note All TACACS+ values are strings. The concept of value type does not exist in TACACS+ as it does in Remote Access Dial-In User Service (RADIUS).

---

TACACS+ AV Pairs

---

Note Beginning with ACS 2.3, some TACACS+ attributes no longer appear on the Group Setup page; because IP pools and callback supersede:
 
   addr
   addr-pool
   callback-dialstring
 
Additionally, these attributes cannot be set via database synchronization, and ip:addr=n.n.n.n is not allowed as a Cisco vendor-specific attribute (VSA).

---

ACS supports many TACACS+ AV pairs. For descriptions of these attributes, refer to Cisco IOS documentation for the release of Cisco IOS that is running on your AAA clients. TACACS+ AV pairs supported in ACS are:

•acl=

•autocmd=

•callback-line

•callback-rotary

•cmd-arg=

•cmd=

•dns-servers=

•gw-password

•idletime=

•inacl#n

•inacl=

•interface-config=

•ip-addresses

•link-compression=

•load-threshold=n

•max-links=n

•nas-password

•nocallback-verify

•noescape=

•nohangup=

•old-prompts

•outacl#n

•outacl=

•pool-def#n

•pool-timeout=

•ppp-vj-slot-
compression

•priv-lvl=

•protocol=

•route

•route#n

•routing=

•rte-ftr-in#n

•rte-ftr-out#n

•sap#n

•sap-fltr-in#n

•sap-fltr-out#n

•service=

•source-ip=

•timeout=

•tunnel-id

•wins-servers=

•zonelist=

TACACS+ Accounting AV Pairs

ACS supports many TACACS+ accounting AV pairs. For descriptions of these attributes, see Cisco IOS documentation for the release of Cisco IOS that is running on your AAA clients. TACACS+ accounting AV pairs that ACS supports are:

•bytes_in

•bytes_out

•cmd

•data-rate

•disc-cause

•disc-cause-ext

•elapsed_time

•event

•mlp-links-max

•mlp-sess-id

•nas-rx-speed

•nas-tx-speed

•paks_in

•paks_out

•port

•pre-bytes-in

•pre-bytes-out

•pre-paks-in

•pre-paks-out

•pre-session-time

•priv_level

•protocol

•reason

•service

•start_time

•stop_time

•task_id

•timezone

•xmit-rate