authentication

This command configures TACACS+ authentication of users.

Syntax

(config-system)# tacacs-settings
(tacacs)# authentication

(tacacs-authentication)#

Command

Description

error-response-consider-as-failure {off|on}

Enables the device to handle a received TACACS+ ERROR response as an authentication failure.

login-tacacs-plus {off|on}

Enables TACACS+ user authentication for the Web interface and CLI.

login-tacacs-plus-allow-console-bypass-authentication {off|on}

Enables bypassing TACACS+ authentication when the user logs into the device through serial communication.

login-tacacs-plus-allow-console-bypass-authentication-authorization {off|on}

Enables bypassing TACACS+ authorization (privilege level) for accessing the CLI Privileged mode when the user is logged into the device through serial communication.

login-tacacs-plus-local {always|never| upon-tacacs+-server-timeout}

Defines if the device falls back to authentication through local user accounts (Local Users table) if TACACS+ authentication fails.

■ never: The device doesn't fall back to authentication through local user accounts if TACACS+ authentication fails. The device rejects the user's login attempt.
■ upon-tacacs+-server-timeout: (Default) The device falls back to authentication through local user accounts only if the TACACS+ server doesn't respond within the configured timeout period.
■ always: The device falls back to authentication through local user accounts when the TACACS+ server returns an ERROR response or is unable to process the authentication request.

Command Mode

Privileged User

Example

This example enables TACACS+ authentication:

(config-system)# tacacs-settings
(tacacs)# authentication

(tacacs-authentication)# login-tacacs-plus on