AAA without TACACS+ ??

Question

Hi all,I'm looking for a solution to grant login into routers/switches using the active directory logon name. This to have a sort of single-sign-on.Looking around I've found that all it's possible using Radius, obviously, but loosing the availability to log all commands written in the CLI. The only technology can do it, as I know, is tacacs+ that is a really old protocol and not integrated in any way with kerberos...Which is your solution? Have u an hint how to solve this thing? I've to manage about 1,000 routers/switches...ThanksStefano

Trendkill · Accepted Answer

Cisco Secure ACS supports A/D authentication.  It would pass the credsfrom the network device to the TACACs server, which then authenticatesdirectly with the domain.  Is that what you are asking?

j4v1v1 · Answer

You can use RADIUS :Freeradius for Linux ( you will need to add Kerberos or LDAP support )IAS for Windows 2000 & 2003 server.IAS:Standard edition : only 50 NAS ( i.e 50 routers )Enterprise Edition ( no limit of devices )From my point of view, if you want to manage 1000 devices, Cisco ACSis the easiest choice.Regards.

News Reader · Answer

His concern is the loss of CLI command authorization and accounting.Best Regards,News Reader

AAA without TACACS+ ??

Join the Discussion

Didn't find your answer?