# TACACS+

> Protect the administration of switches, routers and firewalls with TACACS+: create the application, define authorization profiles and configure the device.

URL: https://docs.ironchip.com/en/identidad/protocolos/tacacs/

TACACS+ lets you authenticate and authorize network device administrators with Ironchip, and record their sessions and commands. Ironchip acts as the TACACS+ server.

## Requirements

- Access to the Ironchip admin console with the administrator role.
- A network device that supports TACACS+ (switches, routers, firewalls).
- Connectivity from the device to Ironchip on TCP port 49.

## Create the application in Ironchip

1. Go to **Applications** and click **New Application**.
2. In the first box, titled **Custom application**, click **Create application**.
3. Give it an identifying name, select the **TACACS+** type and click **Add service**.
4. Fill in these fields:
   - **Shared secret**: the secret shared between the network device and Ironchip. Choose any you like, but it must be the same on the device and in the console. A minimum of 24 characters is recommended.
   - **Devices**: IP addresses or CIDR ranges of the devices allowed to query the TACACS+ server. Requests from other sources are rejected.
   - **Authentication method**: method used to validate the administrator. You can choose Ironchip (passwordless model), LDAP, RADIUS or certificate, depending on what is configured in [centralized validation](https://docs.ironchip.com/en/identidad/protocolos/validacion-centralizada/).
   - **Second factor**: Ironchip OTP or MFA, optional or required.
5. Click **Save**. Ironchip starts listening for TACACS+ requests on TCP port 49.

## Configure authorization profiles

Profiles define what each administrator can do once authenticated.

1. Go to the application you created, open the **Authorization** tab and click **New profile**.
2. Fill in these fields:
   - **Name**: name of the profile, for example `network-admin` or `read-only`.
   - **Privilege level**: privilege level, from 0 to 15, delivered to the device.
   - **Allowed commands**: list of allowed commands, with regular expression support.
   - **Denied commands**: list of denied commands. It takes priority over the allowed list.
3. Assign each profile to an Ironchip user or group.

A user who belongs to several groups receives the highest-privilege profile, unless you define another order of precedence in **Priority**.

All sessions and executed commands are recorded (accounting). You can review them in the **Events** section of the console or export them through [event export](https://docs.ironchip.com/en/identidad/administracion/exportacion-de-eventos/).

## Configure the network device

Configure the device to use Ironchip as the TACACS+ server. This is an example for a device running Cisco IOS:

```text title="Cisco IOS"
aaa new-model
tacacs server ironchip
 address ipv4 <Ironchip IP>
 port 49
 key <shared secret>
aaa group server tacacs+ ironchip-group
 server name ironchip
aaa authentication login default group ironchip-group local
aaa authorization exec default group ironchip-group local
aaa authorization commands 15 default group ironchip-group local
aaa accounting exec default start-stop group ironchip-group
aaa accounting commands 15 default start-stop group ironchip-group
```

:::caution[Keep a local account]
The `local` keyword at the end of each line keeps an emergency local access if the TACACS+ server does not respond. Make sure you keep a local administration account before applying the configuration.
:::

## Verify the integration

To check connectivity, run this on the device:

```text
test aaa group ironchip-group <user> <OTP code> legacy
```

## Authentication example

When connecting to the device over SSH, the administrator enters their username and, in the password field, the second factor (for example, the code from an [OTP](https://docs.ironchip.com/en/identidad/protocolos/otp/)). If the authentication method is Ironchip, the device sends the request to the Ironchip TACACS+ server, which validates the administrator, checks the location and the configured factors, and returns the matching authorization profile.

Some devices do not allow an empty password field. When the authentication method is Ironchip, the text in that field can be random.