2.4.6.1 Configuring TACACS+ Authentication for CLI

Perform the following procedure to enable TACACS+ (Terminal Access Controller Access - Control System Plus) authentication for CLI users as admusr on the Active NOAM server of the topology:

1. Run the following command to replace the <TACACS_SERVER_IP> with the TACACS+ server IP. Providing -t TIMEOUT is optional, by default timeout is set to 10 seconds.

   /usr/TKLC/appworks/bin/tacacsCliAuthentication configure -s <TACACS_SERVER_IP> -A <ACCESS_METHOD> -S <SERVICE> [-p <PROTOCOL>] [-t <TIMEOUT>]

2. Rerun the below command to configure multiple TACACS+ server IPs with different TACACS+ server IPs and their respective details. If all TACACS+ servers share the same metadata, the below command provides support for multiple comma separated TACACS+ server IPs as well:

   /usr/TKLC/appworks/bin/tacacsCliAuthentication configure -s <TACACS_SERVER_IP1>[,<TACACS_SERVER_IP2>] -A <ACCESS_METHOD> -S <SERVICE> [-p <PROTOCOL>] [-t <TIMEOUT>]

   Table 2-60 Command Flag Supported Values

   Command Flag	Supported Values
   Protocol (-p)	ip, ip6, lcp, ipx, atalk, vines, ccp, cdp, multilink, and unknown. Required only when Service (-S) is ppp, optional for all other services.
   Service (-S)	shell, arap, ppp, slip, system, raccess, ftp, telnet, http, https, radius, pptp, vpn, ssh, firewall, connection, and tty-server.
   Access Method (-A)	ssh, console, or ssh,console. SFTP is supported through ssh.