Radiator Server Documentation — v10.34.1

servers.tacacs-plus

Table of Contents

`tacacs-plus`

Defines a named TACACS+ server. Configure one listen block and at least one of clients or @pre-client.

servers {
    tacacs-plus "TACACS" {
        listen {
            protocol tcp;
            port 49;
            ip 0.0.0.0;
            timeout 20s;
        }
        clients "TACACS_DEVICES";
        session-timeout 15m;
        max-packet-size 4096;
        protocol-error-reply true;
        obfuscation client;
        policy "POLICY_TACACS_PLUS";
    }
}

Parameters

Parameter	Required	Description
`listen`	Yes	Configures a TCP or TLS listener. TACACS+ does not support UDP.
`clients`	Conditional	References a static TACACS+ client list.
`@pre-client`	Conditional	Selects clients dynamically before static matching.
`session-timeout`	No	Sets the built-in authorization session lifetime. Default: `15m`.
`max-packet-size`	No	Sets the accepted and outgoing frame limit in bytes. Default: `4096`; range: 12 to 65536.
`protocol-error-reply`	No	Sends a TACACS+ `ERROR` reply before closing for protocol errors. Default: `true`.
`obfuscation`	No	Selects `client` or `disabled`. Default: `client`.
`policy`	No	Routes requests to a named AAA policy.
`capture`	No	Selects a packet capture configuration.
`statistics`	No	Enables local history. Usually leave unset.
`failure-retry-interval`	No	Sets the delay before retrying failed server startup. Default: `30s`.

Listen

Use protocol tcp; with port 49 for standard TACACS+. Use protocol tls; with port 300 for TACACS+ over TLS. Configure the listener with these references:

tls for certificates and TLS behavior
ip-accept for pre-admission filtering
proxy-protocol for proxied connections
keepalive for TCP keepalive probes
timeout for the listener idle timeout

Client Matching

Use clients with a tacacs-plus client list, @pre-client, or both. When both are configured, Radiator tries @pre-client first and uses the static list as a fallback.

Session Timeout

session-timeout controls how long successful authentication state remains available to built-in TACACS+ authorization. It accepts standard duration units. The default is 15m.

Maximum Packet Size

max-packet-size limits incoming and outgoing TACACS+ frames. The value is an integer number of bytes from 12 through 65536. The default is 4096.

protocol-error-reply true; sends an ERROR response for a recognized packet type, or a header-only reply for an unknown packet type, before closing the connection. Set it to false only when the client cannot process protocol error replies.

Obfuscation

obfuscation client; uses the matched client's shared secret to determine whether packet bodies must be obfuscated. obfuscation disabled; always uses unobfuscated packet bodies and ignores client secrets.

See TACACS+ client secrets and obfuscation for the client-side requirements.

TLS

Configure protocol tls; and a tls block for TACACS+ over TLS. Configure client source matching with protocol tls; when TCP and TLS connections from the same address need different client settings.