TAACS+ Parameters

'Enable for Login'

configure system > tacacs-settings > authentication > login-tacacs-plus

[TacPlusEnable]

Enables TACACS+ user authentication for the Web interface and CLI.

■

[0] Check box cleared o = (Default) Disabled.

■

[1] Check box selected þ = Enabled.

'Use TACACS+ Privilege Level'

configure system > tacacs-settings > authorization > login-tacacs-plus

[TacPlusLoginAuthorizationEnable]

Enables TACACS+ user authorization (privilege level) for the Web interface and CLI.

■

[0] Check box cleared o = (Default) Disabled. The device assigns the user the default access level, configured by the [TacPlusDefaultAccessLevel] parameter.

■

[1] Check box selected þ = Enabled. The device uses the privilege level returned by the TACACS+ server to determine the user's access level. The device maps the TACACS+ privilege level to the device's user level according to the TACACS+ Access Level Mapping table. For more information, see Configuring TACACS+ Access Level Mapping. If no mapping exists for the privilege level, the device assigns the user a default access level, configured by the [TacPlusDefaultAccessLevel] parameter.

'Default Access Level'

configure system > tacacs-settings > authorization > default-access-level

[TacPlusDefaultAccessLevel]

Defines which user (access) level the device assigns to the user if no mapping exists between the received TACACS+ privilege level from the TACACS+ server and the device's user level. The device maps the TACACS+ privilege level according to the TACACS+ Access Level Mapping table. For more information, see Configuring TACACS+ Access Level Mapping.

■

[50] Monitor

■

[100] Administrator (default)

■

[200] Security Administrator

'Fallback to Local Users'

configure system > tacacs-settings > authentication > login-tacacs-plus-local

[TacPlusFallbackToLocalUsers]

Defines if the device falls back to authentication through local user accounts (Local Users table) if TACACS+ authentication fails.

■

[0] Never = The device doesn't fall back to authentication through local user accounts if TACACS+ authentication fails. The device rejects the user's login attempt.

■

[1] Upon TACACS+ Server Timeout = (Default) The device falls back to authentication through local user accounts only if the TACACS+ server doesn't respond within the configured timeout period (see Configuring TACACS+ Servers).

■

[2] Always = The device falls back to authentication through local user accounts when the TACACS+ server returns an ERROR response or is unable to process the authentication request.

To configure local users, see Configuring Local Management User Accounts.

'Accounting Login/Logout'

configure system > tacacs-settings > accounting > exec-start-stop-tacacs-plus

[TacPlusLoginAccountingEnable]

Enables the device to send session -level accounting records to the TACACS+ server whenever a user logs in to or logs out of the Web interface or CLI. The device sends a start-record accounting notice when the session starts (i.e., user logs in) and a stop-record when the session ends (i.e., user logs out).

■

[0] Check box cleared o = (Default) Disabled.

■

[1] Check box selected þ = Enabled.

configure system > tacacs-settings > accounting > command-start-stop-tacacs-plus

[TacPlusCmdAccountingEnable]

Enables the device to send CLI command-level accounting records to the TACACS+ server whenever a user executes a command.

■

[0] = (Default) Disabled

■

[1] = Enabled

'Consider TACACS+ Error Response as Failure'

configure system > tacacs-settings > authentication > error-response-consider-as-failure

[TacPlusErrorResponseConsiderAsFailure]

Enables the device to handle a received TACACS+ ERROR response as an authentication failure.

■

[0] Check box cleared o = (Default) Disabled. The device doesn't handle a TACACS+ ERROR response as an authentication failure. Instead, the device treats the response as a server communication problem and continues authentication based on your configured fallback policy (see the [TacPlusFallbackToLocalUsers] parameter). For example, you can configure the device to fallback to the Local Users table to authenticate the user.

■

[1] Check box selected þ = Enabled. The device handles a TACACS+ ERROR response as an authentication failure and rejects the user's login attempt.

configure system > tacacs-settings > authorization > enable-if-authenticated-tacacs-plus

[TacPlusLocalAuthorizationEnable_c]

Enables the use of the local password for CLI Privileged mode when the user is authenticated by TACACS+.

■

[0] = (Default) Disabled

■

[1] = Enabled

system > tacacs-settings > authorization > command-tacacs-plus

[TacPlusCmdAuthorizationEnable]

Enables TACACS+ for CLI command authorization, determining if the user is allowed to execute a specific command.

■

[0] = (Default) Disabled

■

[1] = Enabled. When a user executes a command, the device sends an authorization request to the TACACS+ server. The server either allows or denies the command and the device enforces this decision.

configure system > tacacs-settings > authentication > login-tacacs-plus-allow-console-bypass-authentication

[TacBypassEnable]

Enables bypassing TACACS+ authentication when the user logs into the device through serial communication.

■

[0] = (Default) Disabled

■

[1] = Enabled

configure system > tacacs-settings > authentication > login-tacacs-plus-allow-console-bypass-authentication-authorization

[TacPlusPrivilegedBypassEnable]

Enables bypassing TACACS+ authorization (privilege level) for accessing the CLI Privileged mode when the user is logged into the device through serial communication.

■

[0] = (Default) Disabled

■

[1] = Enabled