Configuration patterns for AAA services

Authentication method lists

An authentication method list named vty-authen is configured to use all TACACS+ servers for authentication. If TACACS+ fails, authentication falls back to the local username database.

configure
aaa authentication login vty-authen group tacacs+ local

The default method list for PPP uses the local method.

aaa authentication ppp default local

Local user configuration

Configure users with secure passwords and specify user groups.

username user1
secret lab
group root-lr
exit

username user2
secret lab
exit

Task groups and user groups

Create a task group, assign tasks, and create a user group that inherits permissions from the task group. Add a description to the user group.

taskgroup tga
task read bgp
task write ospf
exit

usergroup uga
taskgroup tga
description usergroup uga
exit

Configure user2 to inherit from user group uga :

username user2
group uga
exit

TACACS+ server configuration

Add three TACACS servers with specified keywords.

tacacs-server host 10.1.1.1 port 1 key abc
tacacs-server host 10.2.2.2 port 2 key def
tacacs-server host 10.3.3.3 port 3 key ghi

User group for privilege levels

Create a user group named priv5 for users authenticated via TACACS+ with privilege level 5:

usergroup priv5
taskgroup operator
exit

Authorization and accounting method lists

Configure authorization and accounting method lists using TACACS+ servers.

aaa authorization commands vty-author group tacacs+
aaa accounting commands vty-acct start-stop group tacacs+

Line template configuration

Configure line template vty with line password, group assignment, authentication, authorization, and accounting.

line template vty
password lab
users group uga
login authentication vty-authen
authorization commands vty-author
accounting commands vty-acct
exit

TACACS+ server group

Create a TACACS+ server group named abc and add a configured server.

aaa group server tacacs+ abc
server 10.3.3.3
exit