This PPT explain you in easy steps on setting up your Cisco Router with TACACS over ISE Version 2.4

1. TACACS+ with Cisco ISE 2.4 & Cisco Router
Dhruv Sharma

2. In this session we will setup
• We will understand TACACS+ as an authentication algorithm.
• Setup TACACS as an authentication on Cisco Router
• Setup TACACS as an authentication on Cisco ISE 2.4
• Verify the setup

3. TACACS
• Terminal Access Controller Access Control System
• Used to control management access to network equipment such as a switch or a router.
• Uses TCP/49.
• Allows for authorization as well, including shell privileges and command level authorization.
Unlike RADIUS, Authorization happen in different packets.

5. • Topology

7. • Setup the Router

8. Pre-change
• Enable SSH
• Enable Local Authentication

9. Post Change
!
aaa new-model
!
tacacs-server timeout 10
tacacs-server directed-request
tacacs server ISE1
address ipv4 192.168.111.12
key cisco
!

10. Post Change
!
aaa server group tacacs+ ISE_TACACS
server name ISE1
!
aaa authentication login COSOLE line
aaa authentication login VTY group ISE_TACACS local
aaa authorization config-commands
aaa authorization exec default group tacacs local if-authenticated
aaa authorization exec VTY group ISE_TACACS local if-authenticated
aaa authorization commands 1 VTY group ISE_TACACS local if-authenticated
aaa authorization commands 15 VTY group ISE_TACACS local if-authenticated
!

11. Post Change
!
aaa accounting update periodic 15
aaa accounting exec default start-stop group ISE_TACACS
aaa accounting commands 1 default start-stop group ISE_TACACS
aaa accounting commands 15 default start-stop group ISE_TACACS
!

12. Post Change
!
line vty 0 4
transport input ssh
login authentication VTY
exec-timeout 60 0
authorization commands 1 VTY
authorization commands 15 VTY
authorization exec VTY
logging synchronous
login authentication VTY
!

13. • Setup the ISE

14. Setup ISE
We will setup ISE in just 5 simple steps:
• Step 1: Enable Device Admin Services.
• Step 2: Add Network Device
• Step 3: Create TACACS Authorization Profiles
• Step 4: Create Command Sets
• Step 5: Create appropriate profiles.

15. Step 1 of 5
• Enable Device Admin Services.

16. Step 2 of 5
• Add Network Device

17. Step 3 of 5
• Create TACACS Authorization Profiles

18. Step 4 of 5
• Create Command Sets
• One for helpdesk
• One for administrators

19. Step 5 of 5
• Create appropriate profiles.

20. • Testing

21. Testing
• User Neha connects to the router

22. References
• https://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/sec_usr_tacacs/configuration/xe-16/sec-usr-tacacs-xe-16-
book/sec-cfg-tacacs.html

23. • Lab Fun