Content

| 9.7 |  | Authentication, Authorization, and Accounting |
| 9.7.6 |  | Configuring TACACS+ and RADIUS clients |

If a TACACS+ server is used in conjunction with AAA, the device must be configured with the address(es) of the server(s) and the TACACS+ encryption key. The encryption key must be the same on both the TACACS+ server and its clients.

Use the following command to configure the address of a TACACS+ server:

> Router(config)#tacacs-server host ip-address

Use multiple tacacs-server host commands to specify multiple hosts. The Cisco IOS software searches for the hosts in the order specified. The tacacs-server key command configures the encryption key, as shown:

> Router(config)#tacacs-server key word

Figure shows the commands that would be used to configure a router to communicate with a TACACS+ server at 192.168.0.11, using the shared key topsecret.

Use the show tacacs command to verify TACACS+ configuration and connection.

Like TACACS+, devices are configured to use RADIUS by specifying a server address and shared key.

Use the radius-server host command to specify an Internet Protocol (IP) address for the server:

> Router(config)#radius-server host ip-address

Use multiple radius-server host commands to specify multiple hosts. The Cisco IOS software searches for the hosts in the order specified. Use the radius-server key command to specify the encryption key:

> Router(config)#radius-server key word

Figure shows the commands needed to configure a router to communicate with a RADIUS server at 192.168.0.22, using the shared key topsecret.