Wired Intelligent Edge

 View Only
last person joined: 21 hours ago 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Expand all | Collapse all

double login with Tacacs 3810

This thread has been viewed 13 times
  • 1.  double login with Tacacs 3810

    Posted Feb 02, 2021 12:46 PM
    hi 

    I am having trouble getting the 3810 I am configuring to use a single login when tacacs is configured , I read the following :

    "Using the privilege-mode option for login

    When using TACACS+ to control user access to the switch, first login with your username at the operator privilege level using the password for operator privileges, then login again with the same username but using the Manger password to obtain manager privileges. You can avoid this double login process by entering the privilege-mode option with the aaa authentication login command to enable TACACS+ for a single login. The switch authenticates your username/password, then requests the privilege level (operator or manager) that was configured on the TACACS+ server for this username/password. The TACACS+ server returns the allowed privilege level to the switch. You are placed directly into operator or manager mode, depending on your privilege level."

    I have configured "aaa authentication login privilege-mode" but I still need to login twice - the tacacs configuration I have is below :

    aaa accounting commands stop-only tacacs
    aaa accounting exec start-stop tacacs
    aaa accounting system stop-only tacacs
    aaa authentication login privilege-mode
    aaa authentication console login tacacs
    aaa authentication console enable tacacs
    aaa authentication telnet login tacacs
    aaa authentication telnet enable tacacs
    aaa authentication ssh login tacacs
    aaa authentication ssh enable tacacs

    i am new to Aruba and usually work on Alcatel or Cisco - any guidance will be appreciated.

    ------------------------------
    JB
    ------------------------------


  • 2.  RE: double login with Tacacs 3810

    MVP GURU
    Posted Feb 04, 2021 04:13 AM
    What attribute do you send to the switch ?

    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 3.  RE: double login with Tacacs 3810

    Posted Feb 04, 2021 04:31 AM
    thanks for the reply - what do you mean by attribute ? the rest of the config (all done by CLI) is :

    tacacs-server host 10.208.9.6 key "(password)"


    ------------------------------
    jaz birk
    ------------------------------



  • 4.  RE: double login with Tacacs 3810

    MVP GURU
    Posted Feb 06, 2021 10:25 AM
    On TACACS server side ?

    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 5.  RE: double login with Tacacs 3810

    Posted Feb 09, 2021 11:41 AM
    hi 

    that is the config on the switch - 10.208.9.6  being the IP of the tacacs server

    ------------------------------
    jaz birk
    ------------------------------