TACACS+ Enforcement Service

Configure the TACACS+ Enforcement service for any kind of TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  request. TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  users can be authenticated against any of the supported authentication source types:

Local DB

SQL DB

Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed.

LDAP Lightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. Directory

Token Servers with a RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  interface

Similarly, you can specify service-level authorization sources from the Authorization tab. You can associate a role-mapping policy with this service via the Roles tab.

The result of evaluating a TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  enforcement policy is one or more TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  enforcement profiles. For more information on TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  enforcement profiles, see TACACS+ Based Enforcement Profile.

To create a TACACS+ Enforcement service:

1. Navigate to Configuration > Services, then select the Add link. The Add Services page opens.

2. From the Type drop down, select TACACS+ Enforcement. The TACACS+ Enforcement service configuration dialog opens:

Figure 1  Adding a New TACACS+ Enforcement Service

3. Specify the Service tab parameters as described in the following table:

Table 1: Add TACACS+ Enforcement > Service Tab Parameters

Parameter

Action/Description

Type

From the drop-down list, select TACACS+ Enforcement.

Name

Enter the name of the service.

Description

Provide additional information that helps to identify the service.

Monitor Mode

The Monitor Mode option is disabled for an enforcement policy.

More Options

The Authorization tab is not enabled by default.

To bring up the Authorization configuration tab, check the Authorization check box.

Service Rule

Type

Select one of the following service rule types:

Authentication

Connection

Date

Device

Host

Endpoint

Name

Select the name of the service rule from the drop-down list.

Operator

Select an appropriate operator from the list of operators for the data type of the attribute.

For example, you can select from BELONGS_TO, NOT_BELONGS_TO, CONTAINS, or EQUALS.

Value

Select the value from the drop-down list. The value list depends on the operator selected.

Policy Manager provides a way to differentiate between a TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  login authentication and a TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  enable authentication.

To do so, in Service and Policy rule configuration, you can use the Authentication type TacacsAuthenService parameter. This parameter accepts three values: None, Login, or Enable.

Note that an Enforcement policy can also use the Authentication: TacacsAuthenService attribute in the Rules Editor > Conditions section of the policy configuration.

Creating a TACACS+ Multi-Factor Authentication Service

To apply the TacacsAuthenService parameter in a TACACS+ Terminal Access Controller Access Control System+. TACACS+ provides separate authentication, authorization, and accounting services. It is derived from, but not backward compatible with, TACACS.  Enforcement service:

1. Navigate to Configuration > Services, then select the Add link.

The TACACS+ Enforcement service configuration dialog opens:

Figure 2  Configuring a TACACS+ Multi-Factor Authentication Service

2. Specify the TACACS+ Enforcement Service parameters as described in the following table:

Table 2: TACACS+ Enforcement > Service Tab Parameters

Parameter

Action/Description

Type

From the drop-down list, select TACACS+ Enforcement.

Name

Enter the name of the service.

Description

Provide additional information that helps to identify the service.

Monitor Mode

The Monitor Mode option is disabled for an enforcement policy.

More Options

The Authorization tab is not enabled by default.

To bring up the Authorization configuration tab, check the Authorization check box.

Service Rule

Type

Select Click to add, then select the Authentication type.

Name

Select TacacsAuthenService.

Operator

Select EQUALS.

Value

Select one of the following values:

AUTHEN_SVC_NONE: Choose this option when the user does not require authentication.

AUTHEN_SVC_LOGIN: Choose this option when the user is authenticating in Login mode.

AUTHEN_SVC_ENABLE: Choose this option when the user is authenticating in Privileged mode.