This document provides an overview of TACACS+ (Terminal Access Controller Access Control System Plus), which is a protocol and software that provides AAA (authentication, authorization, and accounting) services to network devices. It discusses how TACACS+ separates AAA functions, encrypts traffic between devices, and uses TCP port 49 for communication. Key aspects of TACACS+ authentication, authorization, and accounting are outlined. The document also demonstrates TACACS+ in action using Cisco IOS XR Virtual and CentOS and provides references for further information.

1. Terminal Access Controller
Tacacs+
KHNOG
August, 2016

2. Overview
• Tacacs+ overview
• Why do we need tacacs+?
• Demo
• Question?

3. Tacacs+
• Terminal Access Controller Access Control System Plus
• Protocol and software used to provide AAA services to
an access server or router
• TACACS+ protocol used in communication from NAS and
the TACACS+ daemon running on a security server
• TACACS+ separate Authentication, Authorization and
Accounting and encrypt all traffic between NAS and the
daemon
• Uses TCP port 49 to communicate
• Cisco proprietary
• Outgrowth of TACACS (RFC 1492)

4. vTacacs+ used TCP
vPacket Encryption
vAuthentication and Authorization
vRouter Management
vInteroperability
• Ref: http://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-
service-radius/13838-10.html
Why do we need tacacs+?

5. TACACS+ Packet Encryption
• Entire packet after the TACACS+ header is
encrypted
• Relies on a preshared secret stored on both NAS
and AAA server
• Cipher text generated by XOR clear-text with
concatenated MD5 hashes of session_id,
preshared key, version number, and sequence
number
• Example:

6. TACACS+ Authentication
-uses ‘start’, ‘reply’, and ‘continue’ packets
-authentication results in ‘success’, ‘failure, or ‘error’

7. TACACS+ Authorization
Request contains services or privileges needed to be authorized

8. TACACS+ accounting
Request packet
‘Start’ record indicates that a service is about to begin
‘Continue’ record sent periodically while service is in progress
‘Stop’ record sent when service has terminated
Response packet
‘Success’ status indicates that AAA server has received packet from NAS
and has stored info into its database
‘Error’ implies AAA server failed to commit record to its database
‘Follow’ status indicates that NAS should send the records to another AAA
server listed in packet data

9. DEMO
• CISCO IOSXRV 5.2
• CentOS 6.5

10. Thanks