This document describes how to configure TACACS+ Authentication and Authorization for the Firepower eXtensible Operating System (FXOS) chassis via Identity Services Engine (ISE).
The FXOS chassis includes the following User Roles:
Administrator - Complete read-and-write access to the entire system. The default admin account is assigned this role by default and it cannot be changed.
Read-Only - Read-only access to system configuration with no privileges to modify the system state.
Operations - Read-and-write access to NTP configuration, Smart Call Home configuration for Smart Licensing, and system logs, including syslog servers and faults. Read access to the rest of the system.
AAA - Read-and-write access to users, roles, and AAA configuration. Read access to the rest of the system.
Via CLI this can be seen as follows:
fpr4120-TAC-A /security* # show role
Role Name Priv
Contributed by Tony Remirez, Jose Soto, Cisco TAC Engineers.
Cisco recommends that you have knowledge of these topics:
Knowledge of Firepower eXtensible Operating System (FXOS)
Knowledge of ISE configuration
TACACS+ Device Administration license is required within ISE
The information in this document is based on these software and hardware versions:
Cisco Firepower 4120 Security Appliance version 2.2
Virtual Cisco Identity Services Engine 184.108.40.2060
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
The goal of the configuration is to:
Authenticate users logging into the FXOS’s Web-based GUI and SSH by means of ISE
Authorize users logging into the FXOS’s Web-based GUI and SSH according to their respective User Role by means of ISE.
Verify the proper operation of authentication and authorization on the FXOS by means of ISE
Configuring the FXOS Chassis
Creating a TACACS+ Provider
Step 1. Navigate to Platform Settings > AAA.
Step 2. Click the TACACS tab.
Step 3. For each TACACS+ provider that you want to add (Up to 16 providers).
3.1. In TACACS Providers area, click Add.
3.2. Once the Add TACACS Provider dialog box opens, enter the required values.
3.3. Click OK to close the Add TACACS Provider dialog box.
Step 4. Click Save.
Step 5. Navigate to System > User Management > Settings.
Step 6. Under Default Authentication choose TACACS.
Creating a TACACS+ Provider using CLI
Step 1. In order to enable TACACS authentication run the following commands.
fpr4120-TAC-A# scope security
fpr4120-TAC-A /security # scope default-auth
fpr4120-TAC-A /security/default-auth # set realm tacacs
Step 2. Use the show detail command to verify the configuration.
fpr4120-TAC-A /security/default-auth # show detail
Admin Realm: Tacacs
Operational Realm: Tacacs
Web session refresh period(in secs): 600
Session timeout(in secs) for web, ssh, telnet sessions: 600
Absolute Session timeout(in secs) for web, ssh, telnet sessions: 3600
Serial Console Session timeout(in secs): 600
Serial Console Absolute Session timeout(in secs): 3600
Admin Authentication server group:
Operational Authentication server group:
Use of 2nd factor: No
Step 3. In order to configure TACACS server parameters run the following commands.
fpr4120-TAC-A# scope security
fpr4120-TAC-A /security # scope tacacs
fpr4120-TAC-A /security/tacacs # enter server 10.88.244.50
fpr4120-TAC-A /security/tacacs/server # set descr "ACS Server"
fpr4120-TAC-A /security/tacacs/server* # set key
Enter the key: ******
Confirm the key: ******
Step 4. Use the show detail command to verify the configuration.
fpr4120-TAC-A /security/tacacs/server* # show detail