Configuring Authentication-method Lists for TACACS and TACACS+

You can use TACACS/TACACS+ to authenticate Telnet or SSH access as well as access to the Privileged EXEC level and CONFIG levels of the CLI. When configuring TACACS/TACACS+ authentication, you create authentication-method lists specifically for the different types of access.

Within the authentication-method list, specify TACACS or TACACS+ as the primary authentication method, and specify up to six backup authentication methods as alternates. If TACACS or TACACS+ authentication fails due to an error, the device tries the backup authentication methods in the order they appear in the list.

There are two different authentication-method lists for TACACS or TACACS+ authentication.

• Telnet/SSH - Use the aaa authentication login default command followed by appropriate methods to create an authentication-method list for Telnet or SSH CLI access.
• CLI - Use the aaa authentication enable default command followed by appropriate methods to create a separate authentication-method list for access to the Privileged EXEC and CONFIG levels of the CLI.

The following example creates an authentication-method list that specifies TACACS as the primary authentication method for securing Telnet/SSH access. If TACACS authentication fails due to an error with the server, authentication is performed using local user accounts instead. If local authentication fails, access is denied.

device# configure terminal
device(config)# enable telnet authentication
device(config)# aaa authentication login default tacacs local

The following example creates an authentication-method list that specifies TACACS as the primary authentication method for access to the Privileged EXEC level and CONFIG levels of the CLI. If TACACS authentication fails due to an error with the server, local authentication is used instead. If local authentication fails, no authentication is used, and the device automatically permits access.

device(config)# aaa authentication enable default tacacs local none

The first method parameter (tacacs in the two previous examples) specifies the primary authentication method. The remaining optional method parameters specify additional methods to try if an error occurs with the primary method. A method can be one of the values listed in the Method Parameter column in the following Authentication Method Values table.