System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

TACACS+ server groups

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains the organization and behavior of TACACS+ server groups, covering their operational characteristics and providing instructions for configuring server groups within AAA deployments.

A TACACS+ server group is a named list of external TACACS+ server hosts that

  • includes one or more server commands

  • specifies the hostname or IP address of each external TACACS+ server through individual server commands, and

  • supports up to 10 TACACS+ servers per server group and 10 private TACACS+ servers in Cisco IOS XR.

TACACS+ server group behavior

You can enter one or more server commands to specify the hostname or IP address of an external TACACS+ server. AAA method lists can reference the configured server group for authentication, authorization, or accounting. Separate VRF contexts are supported if needed.

You can configure these maximums:

  • 10 TACACS+ servers per server group

  • 10 private TACACS+ servers

Use this reference to look up TACACS+ server-group behavior and limits before configuring the server group. After adding the intended external TACACS+ servers, use named TACACS+ server groups in AAA method lists for authentication, authorization, or accounting.

Configure TACACS+ server groups

Create a TACACS+ server group to enable AAA method lists to reference a group of external servers for authentication, authorization, or accounting.

A TACACS+ server group allows you to organize multiple external TACACS+ servers into a single, named group. This simplifies AAA method list configuration and enables flexible referencing of external servers. You can also define an optional VRF for the group. After configuration, you can verify server group information as needed.

Before you begin

  • Ensure the external TACACS+ server(s) are accessible from the device.

  • If configuring the same IP address for both global and VRF-specific configurations, server-private parameters are required.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Create the TACACS+ server group.

    Example:

    Router(config)# aaa group server tacacs+ tacgroup1

    Groups different server hosts into distinct lists and enters the server group configuration mode.

  3. Add the TACACS+ server to the server group.

    Example:

    Router(config-sg-tacacs+)# server 192.168.100.0

    Specifies the hostname or IP address of an external TACACS+ server.

    AAA method lists can reference the configured server group for authentication, authorization, or accounting.

  4. Configure the VRF reference for the TACACS+ server group.

    Example:

    Router(config-sg-tacacs+)# vrf vrf-id

    The vrf option specifies the Virtual Private Network (VPN) routing and forwarding (VRF) reference of an AAA TACACS+ server group.

  5. Repeat step 3 for every external server to be added to the server group named in step 2.

  6. Configure the VRF reference for the TACACS+ server group.

    The vrf option specifies the Virtual Private Network (VPN) routing and forwarding (VRF) reference of an AAA TACACS+ server group.

  7. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • Commit: Saves the configuration changes and remains within the configuration session.

    • End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

  8. Display TACACS+ server group information.

    Example:

    Router# show tacacs server-groups

    (Optional) Displays information about each TACACS+ server group that is configured in the system.

The TACACS+ server group is configured and available for use in AAA method lists.