tacacs-plus
Defines a named TACACS+ server. Configure one listen block and at least one
of clients or @pre-client.
servers {
tacacs-plus "TACACS" {
listen {
protocol tcp;
port 49;
ip 0.0.0.0;
timeout 20s;
}
clients "TACACS_DEVICES";
session-timeout 15m;
max-packet-size 4096;
protocol-error-reply true;
obfuscation client;
policy "POLICY_TACACS_PLUS";
}
}
Parameters
| Parameter | Required | Description |
|---|---|---|
listen | Yes | Configures a TCP or TLS listener. TACACS+ does not support UDP. |
clients | Conditional | References a static TACACS+ client list. |
@pre-client | Conditional | Selects clients dynamically before static matching. |
session-timeout | No | Sets the built-in authorization session lifetime. Default: 15m. |
max-packet-size | No | Sets the accepted and outgoing frame limit in bytes. Default: 4096; range: 12 to 65536. |
protocol-error-reply | No | Sends a TACACS+ ERROR reply before closing for protocol errors. Default: true. |
obfuscation | No | Selects client or disabled. Default: client. |
policy | No | Routes requests to a named AAA policy. |
capture | No | Selects a packet capture configuration. |
statistics | No | Enables local history. Usually leave unset. |
Listen
Use protocol tcp; with port 49 for standard TACACS+. Use protocol tls;
with port 300 for TACACS+ over TLS. Configure the listener with these
references:
tlsfor certificates and TLS behaviorip-acceptfor pre-admission filteringproxy-protocolfor proxied connectionskeepalivefor TCP keepalive probestimeoutfor the listener idle timeout
Client Matching
Use clients with a
tacacs-plus client list,
@pre-client, or both. When both are
configured, Radiator tries @pre-client first and uses the static list as a
fallback.
Session Timeout
session-timeout controls how long successful authentication state remains
available to built-in TACACS+ authorization. It accepts standard
duration units. The default is 15m.
Maximum Packet Size
max-packet-size limits incoming and outgoing TACACS+ frames. The value is an
integer number of bytes from 12 through 65536. The default is 4096.
Protocol Error Replies
protocol-error-reply true; sends an ERROR response for a recognized packet
type, or a header-only reply for an unknown packet type, before closing the
connection. Set it to false only when the client cannot process protocol
error replies.
Obfuscation
obfuscation client; uses the matched client's shared secret to determine
whether packet bodies must be obfuscated. obfuscation disabled; always uses
unobfuscated packet bodies and ignores client secrets.
See TACACS+ client secrets and obfuscation for the client-side requirements.
TLS
Configure protocol tls; and a tls block
for TACACS+ over TLS. Configure client source matching with protocol tls;
when TCP and TLS connections from the same address need different client
settings.