Cisco Catalyst SD-WAN User Management Guide, Releases 26.x and Later

PDF

Ciscotac user access

Updated: April 24, 2026

Want to summarize with AI?

Log in

Introduces Ciscotac user access, covering key concepts and specific limitations to guide secure and effective use within the network environment.

Ciscotac user access

Cisco Edge software provides two special user accounts, ciscotacro and ciscotacrw, for use by the Cisco Support team. These user accounts

  • operate using a consent-token challenge and token response authentication, requiring a new token for each login session, and

  • can access SD-WAN Manager web server, SSH Terminal on SD-WAN Manager using a token, including SD-WAN Validator, SD-WAN Controllers, and Cisco vEdge devices.

You can use these user accounts in both cloud and on-premises installations.

Ciscotac user accounts and privileges

The default CLI templates include configuration for the ciscotacro and ciscotacrw users. These users are enabled by default but you can disable them if needed.

  • ciscotacro user: This account belongs to the operator user group and has read-only privileges. This account allows monitoring configurations but does not permit operations that modify network configurations.

  • ciscotacrw user: This account belongs to the netadmin user group and has read-write privileges. This account allows modification of network configurations. Only this user can access the root shell using a consent token.

To allow the network administrator can access system shell, use the tools consent-token command. Starting Cisco Catalyst SD-WAN Control Components Release 20.12.x, the request support ciscotac command is deprecated.

Limitations for Ciscotac user access

Ciscotac user sessions

  • Only 16 concurrent sessions are supported for the ciscotacro and ciscotacrw users.

  • The session duration is restricted to four hours. It is not configurable.

  • The inactivity timer functionality closes user sessions that have been idle for a specified period of time. This feature is enabled by default and the timeout value is 30 minutes. However, the user configuration includes the option of extending the inactivity timer.

Removing Ciscotac users

You can remove the ciscotacro and ciscotacrw users. If removed, you can open a case and share temporary login credentials or share the screen with the Cisco Support team for troubleshooting an issue.