Cisco Router IOS XR Manual do Utilizador descarregar pdf (Página 43)

Cisco IOS XR Training Page 43

12. TACACS Configuration

(default and non-default VRF)

Ok, so you want to secure your IOS-XR device using TACACS.

The first example I will use will be using the default VRF for TACACS

authorization and the second will be using a different VRF. For these

examples, the tacacs server is at IP 192.168.100.100 and the password is

TacacsPassword

First up, we need to configure our source interface for TACACS, here we will

use loopback0 and the default VRF.

RP/0/RSP0/CPU0:PE2(config)#tacacs source-interface Loopback0 vrf default

Now we can configure our TACACS server and Password

RP/0/RSP0/CPU0:PE2(config)#tacacs-server host 192.168.100.100

RP/0/RSP0/CPU0:PE2(config-tacacs-host)#key 0 TacacsPassword

RP/0/RSP0/CPU0:PE2(config-tacacs-host)#exit

RP/0/RSP0/CPU0:PE2(config)#

Time to create a local console authenticaion method, this way console does

not rely on TACACS.

You may or may not want to do this, but I am showing it for these examples.

RP/0/RSP0/CPU0:PE2(config)#aaa authentication login console local

RP/0/RSP0/CPU0:PE2(config)#aaa authorization commands console none

Apply the console loging to the line console

RP/0/RSP0/CPU0:PE2(config)#line console

RP/0/RSP0/CPU0:PE2(config-line)#login authentication console

RP/0/RSP0/CPU0:PE2(config-line)#authorization commands console

RP/0/RSP0/CPU0:PE2(config-line)#exit

RP/0/RSP0/CPU0:PE2(config)#

Now we can start to configure our AAA for login, here I am using default

RP/0/RSP0/CPU0:PE2(config)#aaa authentication login default group tacacs+ local

Now for some command authorization, if you want it

RP/0/RSP0/CPU0:PE2(config)#aaa authorization commands default group tacacs+

And accounting as well.

RP/0/RSP0/CPU0:PE2(config)#aaa accounting exec default start-stop group tacacs+

RP/0/RSP0/CPU0:PE2(config)#aaa accounting system default start-stop group tacacs+

RP/0/RSP0/CPU0:PE2(config)#aaa accounting commands default start-stop group tacacs+

Since this is IOS XR, I strongly suggest using a commit confirmed here!

RP/0/RSP0/CPU0:PE2(config)#commit confirmed minutes 2

Thu Oct 18 03:22:57.487 UTC

RP/0/RSP0/CPU0:PE2(config)#

1 2 ... 38 39 40 41 42 43 44 45 46 47 48 ... 104 105

Sem comentários

Cisco Router IOS XR Manual do Utilizador Página 43