System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Per-VRF TACACS+ server groups

Updated: September 18, 2026

Want to summarize with AI?

Outlines per-VRF TACACS+ server group functionality, highlighting specific behavior, prerequisites, and task-based procedures for configuring server groups within Virtual Routing and Forwarding (VRF) environments.

A per-VRF TACACS+ server group is a TACACS+ server-group configuration that

associates private TACACS+ server entries with a VRF instance for AAA reachability
uses server-private and VRF commands for feature configuration, and
allows server status, statistics, and keys to differ by VRF context.

Additional reference information

Global server definitions can be referenced by multiple server groups, but all references use the same server instance.

Behavior and prerequisites for TACACS+ server groups in per-VRF configurations

Cisco IOS XR software supports per-VRF AAA for TACACS+ server groups, enabling flexible configuration scenarios for both private and global server definitions. You can use the server-private and vrf commands to configure this feature.

Key behaviors and features

You can refer to global server definitions from multiple server groups. All references use the same server instance and connect to the same server.
For VRF configurations, global server configuration is not strictly required, because server status, statistics, and keys can differ across VRFs.
Use private server configuration when each VRF requires the same TACACS+ server to have different status, statistics, or keys.
If the same server is used in different groups with different VRFs, ensure that the server is reachable from all those VRFs.
When migrating servers to a VRF, it is safe to remove the global server configuration for that server, since per-VRF configuration takes precedence.

Prerequisites

Before configuring per-VRF TACACS+ server groups, verify these requirements:

Be familiar with configuring TACACS+, AAA, per VRF AAA, and group servers.
Ensure you have access to the TACACS+ server itself.
Configure the VRF instance prior to setting up the specific VRF for a TACACS+ server and ensure the VRF is reachable.

Usage considerations

Global server definitions can be reused across server groups unless distinct status or authentication keys are required per VRF.
Private server configuration is recommended when VRF-specific differences are essential.
Plan for migration to VRF-specific configuration by ensuring server reachability and removing obsolete global server settings when no longer needed.

Configure per-VRF TACACS+ server groups

Configure a TACACS+ server group so that private TACACS+ servers are reached through a specific VRF.

Use this task when TACACS+ server status, statistics, or keys need to differ by VRF and you want to define separate private TACACS+ server entries associated with specific VRFs.

Before you begin

Before you configure per-VRF TACACS+ server groups, verify these requirements

Be familiar with configuring TACACS+, AAA, per VRF AAA, and group servers.
Ensure that you have access to the TACACS+ server.
Configure the VRF instance before configuring the specific VRF for a TACACS+ server and ensure that the VRF is reachable.

Procedure

Configure the per-VRF TACACS+ server group.
Example:
```
Router# configure
Router(config)# aaa group server tacacs+ tacgroup1
Router(config-sg-tacacs+)# server-private 10.1.1.1 port 49 key a_secret
Router(config-sg-tacacs+)# vrf test-vrf
Router(config-sg-tacacs+)# commit
```
Cisco IOS XR software supports per-VRF AAA on TACACS+ server groups.

Use the server-private and vrf commands to configure this feature.

You can refer to global server definitions from multiple server groups.

All references use the same server instance and connect to the same server.

For VRF, you do not need the global configuration because the server status, server statistics and the key could be different for different VRFs.

Use the server-private configuration to configure per-VRF TACACS+ server groups.

If the same server is used in different groups with different VRFs, ensure that the server is reachable through all those VRFs.

If you are migrating the servers to a VRF, it is safe to remove the global server configuration for that server.

The configuration groups different server hosts into distinct lists and enters server-group configuration mode.

You can enter one or more server commands.

The server command specifies the hostname or IP address of an external TACACS+ server.

AAA method lists can reference the configured server group for authentication, authorization, or accounting.

The server-private command configures the IP address and secret key of the private TACACS+ server that is reachable through a specific VRF.

You can configure multiple private server entries that are reachable through the same VRF.

The vrf option specifies the VRF reference for a AAA TACACS+ server group.

Review the per-VRF TACACS+ running configuration.

Example:

aaa group server tacacs+ tacgroup1
 vrf test-vrf
 server-private 10.1.1.1 port 49
  key 7 0822455D0A16
 !
 server-private 10.1.1.2 port 49
  key 7 05080F1C2243
 !
 server-private 2001:db8:1::1 port 49
  key 7 045802150C2E
 !
 server-private 2001:db8:1::2 port 49
  key 7 13061E010803
 !
!

Verify per-VRF TACACS+ server-group information.

Example:

Router# show tacacs
Fri Sep 27 11:14:34.991 UTC

Server: 10.1.1.1/49 vrf=test-vrf [private]
        opens=0 closes=0 aborts=0 errors=0
        packets in=0 packets out=0
        status=up single-connect=false family=IPv4

Server: 10.1.1.2/49 vrf=test-vrf [private]
        opens=0 closes=0 aborts=0 errors=0
        packets in=0 packets out=0
        status=up single-connect=false family=IPv4

Server: 2001:db8:1::1/49 vrf=test-vrf [private]
        opens=0 closes=0 aborts=0 errors=0
        packets in=0 packets out=0
        status=up single-connect=false family=IPv6

Server: 2001:db8:1::2/49 vrf=test-vrf [private]
        opens=0 closes=0 aborts=0 errors=0
        packets in=0 packets out=0
        status=up single-connect=false family=IPv6

The TACACS+ server group uses private TACACS+ server entries and the configured VRF for server reachability.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.