System Setup and Software Installation Guide for Cisco NCS 1004

PDF

System Setup and Software Installation Guide for Cisco NCS 1004

TACACS+ security protocol

Updated: July 17, 2026

Want to summarize with AI?

Log in

This topic explains how TACACS+ security protocol enhances device security by centralizing user authentication, authorization, and accounting.

TACACS+ is a security protocol designed to provide centralized authentication, authorization, and accounting services for network devices. The protocol offers:

  • centralized user validation for enhanced security,

  • detailed accounting information for monitoring user activities, and

  • flexible administrative control over user access and permissions.

TACACS+ authentication flow on NCS 1004

The TACACS+ application is designed to enhance the security of the NCS 1004 device by centralizing user validation. It uses AAA commands and can be enabled and configured on NCS 1004 for improved security.

When the TACACS+ server is configured and protocol is enabled on the node, user credentials are authenticated through the TACACS+ server. When the user attempts to log into the node, the user name and password are forwarded to the configured TACACS+ servers to obtain authentication status.

If authentication fails through the TACACS+ server, the credentials are sent to the node and authenticated locally. If the authentication fails against the node, the user is not allowed to log into the node.

Configure TACACS+ server groups

TACACS+ server groups help organize existing server hosts into logical groups. This allows you to select a subset of preconfigured server hosts for a particular service.

Before you begin

For successful configuration, the external server must be accessible at the time of configuration. If you assign the same IP address for global configuration, you must specify server-private parameters.

Configuring NCS 1004 to use AAA server groups allows you to group existing server hosts. The system uses a server group along with a global server host list. The server group includes the IP addresses of selected server hosts.

You can enter one or more server commands. The server command specifies the hostname or IP address of an external TACACS+ server. After configuration, you can reference this server group from the AAA method lists for authentication, authorization, or accounting.

To configure TACACS+ server groups, complete these subtasks:

Procedure

1.

Configure TACACS+ server parameters. For details, see Configure TACACS+ server parameters.
2.

Enable AAA authentication and authorization for the TACACS+ server group. For details, see Enable TACACS+ authentication and authorization.

Configure TACACS+ server parameters

This task configures the basic TACACS+ server group and adds external TACACS+ servers with their IP addresses, port numbers, encryption keys, and timeout values.

Procedure

1.

Enter the IOS XR configuration mode.

Example:

RP/0/RP0/CPU0:ios# configure
2.

Enter the aaa group server tacacs+ command to create an AAA server-group and access the server-group sub-configuration mode.

Example:

RP/0/RP0/CPU0:ios(config)# aaa group server tacacs+ tacgroup1
3.

Enter the server-private command to configure the IP address of the private TACACS+ server for the group server.

Example:

RP/0/RP0/CPU0:ios(config-sg-tacacs+)# server-private 10.1.1.1 port 49 key a_secret
Note

  • You can configure up to ten TACACS+ private servers in a server group.

  • If you do not specify private server parameters, the system uses global configurations. If you do not specify global configurations, the system uses default values.
4.

Enter the key command to configure the authentication and encryption key used between NCS 1004 and the TACACS+ daemon running on the TACACS+ server.

Example:

RP/0/RP0/CPU0:ios(config-sg-tacacs+)# key 7 08984B1A4D0C19157A5F57

If no key string is specified, the global value is used.
5.

Enter the timeout command to configure the timeout value that sets the length of time the AAA server waits to receive a response from the TACACS+ server.

Example:

RP/0/RP0/CPU0:ios(config-sg-tacacs-private)# timeout 4
6.

Repeat steps 3 through 5 to add additional servers to the server group.

What to do next

After configuring the TACACS+ server parameters, enable AAA authentication and authorization for the TACACS+ server group. For details, see Enable TACACS+ authentication and authorization.

Enable TACACS+ authentication and authorization

Enable AAA for the TACACS+ server group and verify the configuration.

Before you begin

Ensure that you have configured the TACACS+ server parameters. For details, see Configure TACACS+ server parameters.

Procedure

1.

Enter the aaa authorization exec command to configure certificate-based authentication for users in TACACS+ server groups.

Example:

RP/0/RP0/CPU0:ios(config-sg-tacacs-private)# aaa authorization exec default group TACACS_ALL local
2.

Enter the aaa authorization login command to set the default authentication method list and enable authentication for the console in global configuration mode.

Example:

RP/0/RP0/CPU0:ios(config-sg-tacacs-private)# aaa authentication login default group TACACS_ALL local
3.

Commit the changes and exit all configuration modes.

Example:

RP/0/RP0/CPU0:ios(config-sg-tacacs-private)# commit
RP/0/RP0/CPU0:ios(config-sg-tacacs-private)# end
4.

(Optional) Enter the show tacacs server-groups command to verify the TACACS+ server group configuration details.

Example:

RP/0/RP0/CPU0:ios# show tacacs server-groups
User activity accounting records are sent to the TACACS+ security server. This enables robust management, billing, and auditing.

Configure TACACS+ server

Enabling the AAA accounting feature on a switch allows it to track the network services that users are accessing and the amount of network resources they are using. The switch then sends this user activity data to the TACACS+ security server in the form of accounting records. Each record contains attribute-value pairs and is saved on the security server for analysis. This data can be used for network management, client billing, or auditing purposes.

Procedure

1.

Enter the IOS XR configuration mode.

Example:

RP/0/RP0/CPU0:ios# configure
2.

Enter the aaa accounting exec command to enable the TACACS+ accounting to send a start-record accounting notice at the beginning of a privileged EXEC process and a stop-record at the end.

Example:

RP/0/RP0/CPU0:ios(config)# aaa accounting exec default start-stop group TACACS_ALL
3.

Enter the aaa accounting exec command to create a default command accounting method list for accounting services provided by a TACACS+ security server.

Example:

RP/0/RP0/CPU0:ios(config)# aaa accounting exec default start-stop group TACACS_ALL

This list is configured for privilege level commands and set with a stop-only restriction.
The switch begins recording user access to network services and sends accounting records to the TACACS+ server for management, billing, or auditing.