servers.clients

clients

clients references a named static client list for server-side client matching.

Repeat clients to reference multiple lists:

servers {
    tacacs_plus "TACACS_PLUS" {
        listen {
            protocol tcp;
            ip 0.0.0.0;
            port 49;
        }
        policy "POLICY_TACACS_PLUS";

        clients "FIRST_CLIENTS";
        clients "SECOND_CLIENTS";
    }
}

Lists are checked in declaration order. The first list with a matching client wins. Within each list, the existing IP prefix and protocol matching rules apply. If the IP match does not allow the listener transport, matching continues with the next list. TLS certificate matching also skips clients that do not allow TLS, regardless of list order. Each referenced list must exist and use the server's protocol. Each static lookup uses one complete configuration generation, including during reloads.

Each TCP listener uses one transport mode. A tls block enables TLS-only connections. Without that block, the listener accepts non-TLS connections. Configure separate listeners on distinct addresses or ports to support both modes. Client lists can contain clients for both modes, but each listener only selects clients that allow its transport.

Configure @pre_client to query a backend, script, or database first and fall back to these lists if no client is selected. There is no default client list.

A server must configure at least one of clients or @pre_client. See Client matching order in the @pre_client reference for the lookup and fallback rules when both are configured.