Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

TACACS+ authentication

Updated: April 17, 2026

Want to summarize with AI?

Log in

Describes a remote AAA protocol that provides authentication, authorization, and accounting services for network devices.

TACACS+ authentication is a remote AAA protocol that

  • provides independent AAA facilities, allowing devices to authorize access without authenticating

  • uses TCP to send data between the AAA client and server, enabling reliable transfers with a connection-oriented protocol

  • encrypts the entire protocol payload between the switch and the AAA server to ensure higher data confidentiality

  • uses av-pairs that are syntactically and configurationally different than RADIUS but the Cisco APIC supports shell:domains.

TACACS+ authentication advantages

Terminal Access Controller Access Control System Plus (TACACS+) is another remote AAA protocol that is supported by Cisco devices. TACACS+ has advantages over RADIUS authentication.

Guidelines and limitations apply when using TACACS+:

  • The TACACS server and TACACS ports must be reachable by ping.

  • The TACACS server with the highest priority is considered first to be the primary server.

Note

While the examples provided here use IPv4 addresses, IPv6 addresses could also be used.

TACACS+ provider configuration

This XML example configures the Cisco Application Centric Infrastructure (ACI) fabric to work with a TACACS+ provider at IP address 10.193.208.9:

<aaaTacacsPlusProvider name="10.193.208.9"
           key="test123"
           authProtocol="pap"/>

TACACS+ authentication over TLS

Starting with Release 6.1.4, you can configure TACACS+ providers over Transport Layer Security (TLS). TACACS+ over TLS uses certificate-based authentication and supports TLS version 1.3.

A TACACS+ login domain must use either TLS-based TACACS+ providers or non-TLS-based TACACS+ providers, but it cannot use both simultaneously.

Configure APIC for TACACS+ access

This task enables TACACS+ authentication for user access to the APIC.

TACACS+ provides centralized authentication, authorization, and accounting services for network access. This configuration is essential for enterprise environments that require secure, centralized user management.

Before you begin

  • The Cisco Application Centric Infrastructure (ACI) fabric is installed, Application Policy Infrastructure Controllers (APICs) are online, and the APIC cluster is formed and healthy.

  • The TACACS+ server host name or IP address, port, and key are available.

  • The APIC management endpoint group is available.

Procedure

  1. In the APIC, create the TACACS+ Provider.

    For configuring a TACACS+ provider, see Create a provider.

    For toggling in-band or out-of-band management in the APIC GUI:

    In the Navigation pane, choose System > System Settings > APIC Connectivity Preferences. In the Work Pane select either inband or ooband.

  2. Create the Login Domain for TACACS+.

    For the detailed procedure, see Create login domain using the GUI.

The APIC is now configured for TACACS+ authentication with the provider and login domain created.

What to do next

This completes the APIC TACACS+ configuration steps. Next, if a RAIDUS server will also be used, configure the APIC for RADIUS. If only a TACACS+ server will be used, go to the ACS server configuration topic below.

Configure TACACS in APIC using the REST API

This task enables TACACS+ authentication in APIC to provide centralized authentication, authorization, and accounting services for network device access.

TACACS+ configuration in APIC requires setting up providers, login domains, and optionally TLS encryption for secure communication. The REST API provides a programmatic approach to configure these components.

Before you begin

Make sure that you configure aaaTacacsPlusProviderGroup with the same name as the name of the TACACS login domain.

Follow these steps to configure TACACS in APIC using the REST API:

Procedure

  1. Configure the TACACS+ provider by sending an HTTP POST request.

    Example:

    
HTTP POST to https://{{apichost}}/api/node/mo/.xml
<aaaTacacsPlusProvider name="server.tacacs.local" 
    authProtocol="pap" 
    monitorServer="enabled" monitoringUser="user1" monitoringPassword="mypwd" 
    port="49" retries="1" key="mykey" timeout="15" />

  2. Configure a login domain for TACACS using the REST API.

    Example:

    
HTTP POST to https://{{apichost}}/api/node/mo/.xml
<aaaUserEp  descr="" dn="uni/userext"  name=""  pwdStrengthCheck="yes" rn="" status="modified">
    <aaaLoginDomain  descr=""  name="Tacacs" nameAlias=""  rn="logindomain-Tacacs" status="created,modified">
        <aaaDomainAuth  descr="" name="" nameAlias=""  providerGroup="Tacacs" 
            realm="tacacs" rn="domainauth" status="created,modified"/>
    </aaaLoginDomain>
    <aaaTacacsPlusEp  descr="" name="" nameAlias=""  retries="1" rn="tacacsext" status="created,modified" timeout="5">
        <aaaTacacsPlusProviderGroup  descr="" name="Tacacs" nameAlias="" 
            rn="tacacsplusprovidergroup-Tacacs" status="created,modified">
            <aaaProviderRef descr="testing" name="tacacs.server.com" nameAlias="" order="1" 
                rn="providerref-tacacs.server.com"  status="created,modified" />
            <aaaProviderRef descr="testing" name="tacacs2.server.com" nameAlias="" order="2" 
                rn="providerref-tacacs2.server.com"  status="created,modified" />
        </aaaTacacsPlusProviderGroup>
    </aaaTacacsPlusEp>
</aaaUserEp>

  3. Configure keyring certificate for APIC nodes using the REST API.

    Example:

    
HTTP POST https://{{apichost}}/api/node/mo/uni/userext/pkiext/keyring-{{tacacs-tls-keyring}}.xml
<pkiKeyRing dn="uni/userext/pkiext/keyring-{{tacacs-tls-keyring}}"   
    tp="tacacs-tls-tp" eccCurve="none" keyType="RSA" 
    descr="tac client ca" status="created,modified"
    key="-----BEGIN PRIVATE KEY-----
   ..................................
   ..................................
    -----END PRIVATE KEY-----"  
    cert="-----BEGIN CERTIFICATE-----
   ..................................
   ..................................
    -----END CERTIFICATE-----"
/pkiKeyRing>

  4. Configure trust point to trust TACACS+ provider using the REST API.

    Example:

    
HTTP POST https://{{apichost}}/api/node/mo/uni/userext/pkiext/tp-{{tacacs-tls-tp}}.xml
<polUni>
    <aaaUserEp>
        <pkiEp>
            <pkiTP dn="uni/userext/pkiext/tp-{{tacacs-tls-tp}}" name="tacacs-tls-tp"
                certUsage="WebSvcOrAuth" status="created,modified"
                certChain="-----BEGIN CERTIFICATE-----
      ....................................
      ....................................
            -----END CERTIFICATE-----"/>
        </pkiEp>
    </aaaUserEp>
</polUni>

  5. Configure TACACS+ provider over TLS using the REST API.

    Example:

    
https://{{apic-ip}}/api/node/mo/uni.xml

<?xml version="1.0" encoding="UTF-8"?>
<imdata totalCount="1">
    <aaaTacacsPlusProvider enableTLS="true" dn="uni/userext/tacacsext/tacacsplusprovider-{{tacacs-tls-providername}}" 
SSLValidationLevel="permissive" port="6049" status="created,modified" descr="TLS ISE provider" 
keyring="{{tacacs-tls-keyring}}" name="{{tacacs-tls-providername}}" tp="{{tacacs-tls-tp}}" 
key="" userdom="all">
    <aaaRsSecProvToEpg tDn="uni/tn-mgmt/mgmtp-default/oob-default"/>
    </aaaTacacsPlusProvider>
</imdata>

TACACS+ authentication is configured in APIC with the specified providers, login domains, and optional TLS encryption for secure communication.