settings tacacs

The settings tacacs command configures the verification of the users over a TACACS server when signing in to the management interface and to the WEB-CLI. The same command also manages the accounting record in which the operations performed are reported to the server.

Command Summary

TR7 WEB-CLI · settings tacacs

# Tab after the command

admin@TR7LBWAF01> settings tacacs

show update

 

admin@TR7LBWAF01> settings tacacs show # show the settings

admin@TR7LBWAF01> settings tacacs update … # change

admin@TR7LBWAF01>  

Required Fields

This resource is a single setting: no identifier is written, update is run directly and only the fields to be changed are given. There is a single exception: the accounting password is asked on every update.

Order	Field	Status	Value
1	accountingPassword	Required	It is not written on the command line; on every settings tacacs update command it is asked on the Accounting password: line after Enter is pressed, without appearing on the screen

TR7 WEB-CLI · the accounting password is asked hidden

admin@TR7LBWAF01> settings tacacs update --port 49

Accounting password: # the characters typed do not appear on the screen

admin@TR7LBWAF01>  

Why it is asked on every update

Since the password fields are not read back from the old record on an update, they are requested again by the CLI. Since the condition of the accounting password looks at whether the --accounting field carries a value and the default of this field is false, the condition is always met; the password is asked even while accounting is off.

The Server Fields

Field	What it does	What is written after it
--host	Determines the TACACS server the verification will be done on	The server name or IP address; the port is not written in this field
--port	Determines the port of the server	A port number
--secret	Determines the secret key shared between the device and the server	The key defined on the server for this device

The Accounting Fields

When accounting is turned on, the operations performed on the device are reported to the TACACS server.

Field	What it does	What is written after it
--accounting	Turns on the reporting of the operation records to the TACACS server	true · false (the default is false)
--accountingUsername	Determines which user the record reports will be sent with	A user name defined on the server
accountingPassword	Determines the password of that user	It is not written on the command line; it is asked hidden after the command (see The Required Fields)
--accountingServiceName	Determines the service name that appears in the report	A service name (the default is ppp)
--accountingProtocolName	Determines the protocol name that appears in the report	A protocol name (the default is ip)
--accountingLanguage	Selects the language of the reported record texts	en · tr. When it is left empty, the default language of the device is used

Examples

TR7 WEB-CLI · TACACS

# signing in only

admin@TR7LBWAF01> settings tacacs update --host 10.0.1.40 --port 49 --secret <key>

Accounting password:

 

# the operation records should be reported to the server too

admin@TR7LBWAF01> settings tacacs update --accounting true \

--accountingUsername tr7-acct \

--accountingServiceName ppp --accountingProtocolName ip --accountingLanguage tr

Accounting password:

admin@TR7LBWAF01> settings tacacs show

admin@TR7LBWAF01>  

Things to Know

• The accounting fields always appear in the list. The condition of these fields looks at whether the --accounting field carries a value; since the default of the field is false, the condition is met in every case. In order for the fields to have an effect, --accounting true must have been written.
• The accounting user is a separate account. The account given with --accountingUsername is for sending the record reports; it has nothing to do with the users who sign in.
• The record language can be left empty. When --accountingLanguage is not given, the default language of the device is used; the default language is determined in the settings localization command.
• The opening of the users is a separate setting. Whether the user verified with TACACS will be opened by itself on the device is determined in the settings user-management command; tacacs must be added to the source list there.
• The secret key must be the same on both sides. If the --secret value does not match exactly the key defined on the server for this device, the verification request stays unanswered.