Skip to main content

TACACS (AAA) Configuration in Cisco IOS XR

·568 words·3 mins
Rory
Author
Rory
Step by step the ladder is ascended

Notes.
#

aaa authorization exec console local
aaa authentication login console local
aaa authorization commands console none

line console
 authorization commands console
 login authentication console
 authorization exec console

在变更AAA配置之前一定要确保将console 配置为本地认证授权, 防止错误的配置导致无法修改配置.

或者在变更AAA配置时不使用commit,使用”commit confirmed minutes x“.

这条命令的意思是如果不进行第二次”commit“ 操作,配置将在x分钟后进行配置回滚

RP/0/RSP0/CPU0:ios(config)#commit confirmed minutes 5
测试AAA, 测试无误后再进行commit
RP/0/RSP0/CPU0:ios(config)#commit

default VRF
#

tacacs source-interface Loopback0 vrf default
tacacs-server host 10.70.79.177 port 49
 key 7 110A1016141D
!
aaa accounting commands default start-stop group tacacs+
aaa authorization exec console local
aaa authorization exec default group tacacs+ local
aaa authorization commands console none
aaa authorization commands default group tacacs+ none
aaa authentication login console local
aaa authentication login default group tacacs+ local

non-default VRF
#

tacacs source-interface MgmtEth0/RSP0/CPU0/0 vrf MGMT
tacacs-server host 10.70.79.177 port 49
 key 7 110A1016141D
!
aaa accounting commands default start-stop group XU
aaa group server tacacs+ XU
 server 10.70.79.177
 vrf MGMT
!
aaa authorization exec console local
aaa authorization exec default group XU local
aaa authorization commands console none
aaa authorization commands default group XU none
aaa authentication login console local
aaa authentication login default group XU local

User-Defined User Groups/Task Groups example
#

taskgroup priv1
 task read bgp
 task read ipv4
 task read isis
 task read interface
 task write basic-services
 task execute basic-services
 description view_only
!
taskgroup priv5
 task read aaa
 task read acl
 task read atm
 task read bfd
 task read bgp
 task read cdp
 task read cef
 task read ppp
 task read qos
 task read rib
 task read bcdl
 task read boot
 task read diag
 task read hdlc
 task read hsrp
 task read ipv4
 task read isis
 task read snmp
 task read vlan
 task read admin
 task read bundle
 task read fabric
 task read static
 task read sysmgr
 task read system
 task read drivers
 task read logging
 task read monitor
 task read netflow
 task read network
 task read pos-dpt
 task read pkg-mgmt
 task read fault-mgr
 task read interface
 task read inventory
 task read route-map
 task read sonet-sdh
 task read filesystem
 task read tty-access
 task read config-mgmt
 task read ip-services
 task read route-policy
 task read host-services
 task read basic-services
 task read config-services
 task write basic-services
 task execute filesystem
 task execute basic-services
 description read_only_all
!
taskgroup priv10
 task write acl
 task write bgp
 task write cdp
 task write cef
 task write ppp
 task write qos
 task write boot
 task write diag
 task write ipv4
 task write isis
 task write snmp
 task write admin
 task write static
 task write sysmgr
 task write system
 task write logging
 task write monitor
 task write netflow
 task write network
 task write pkg-mgmt
 task write interface
 task write inventory
 task write route-map
 task write sonet-sdh
 task write ip-services
 task write route-policy
 task write basic-services
 task execute bgp
 task execute admin
 task execute logging
 task execute pkg-mgmt
 task execute sonet-sdh
 inherit taskgroup priv5
!
usergroup priv1
 taskgroup priv1
 description view_only

usergroup priv5
 taskgroup priv5
 description read_only_all
!
usergroup priv10
 taskgroup priv10
 description priv15_without_aaa
!
usergroup priv15
 taskgroup root-system
 taskgroup cisco-support
 description pri15

line template
#

删除line default配置, 并配置客户自己的temple:

RP/0/RSP0/CPU0:ASR9006-A#show run line template SSH
Sat Jul 23 19:55:49.536 UTC
line template SSH
login authentication SSH
transport input ssh

RP/0/RSP0/CPU0:ASR9006-A#show run | in vty
Sat Jul 23 20:05:46.117 UTC
Building configuration...
vty-pool default 0 4 line-template SSH

RP/0/RSP0/CPU0:ASR9006-A#show run aaa
Sat Jul 23 20:06:11.770 UTC
aaa authentication login SSH group tacacs+ local

Reference
#