Rockwell Automation 1783-WAPxxx Stratix 5100 Wireless Access Point User Manual - Manual (Page 434)

434 Rockwell Automation Publication 1783-UM006A-EN-P - May 2014
Chapter 14 Configuring RADIUS and TACACS+ Servers
Default TACACS+ Configuration
TACACS+ and AAA are disabled by default.
To prevent a lapse in security, you cannot configure TACACS+ through a
network management application. When enabled, TACACS+ can authenticate
administrators accessing the access point through CLI.
Identifying the TACACS+ Server Host and Setting the Authentication
Key
You can configure the access point to use a single server or AAA server groups to
group existing server hosts for authentication. You can group servers to select a
subset of the configured server hosts and use them for a particular service. The
server group is used with a global server-host list and contains the list of IP
addresses of the selected server hosts.
Beginning in privileged EXEC mode, follow these steps to identify the IP host or
host maintaining TACACS+ server and optionally set the encryption key:
1. Enter global configuration mode.
configure terminal
2. Identify the IP host or hosts maintaining a TACACS+ server.
Enter this command multiple times to create a list of preferred hosts. The
software searches for hosts in the order that you specify.
• For
hostname , specify the name or IP address of the host.
• (Optional) For
port integer , specify a server port number.
The default is port 49. The range is 1…65535.
• (Optional) For
timeout integer , specify a time in seconds the
access point waits for a response from the daemon before it times out
and declares an error.
The default is 5 seconds. The range is 1…1000 seconds.
• (Optional) For
key string , specify the encryption key for
encrypting and decrypting all traffic between the access point and the
TACACS+ daemon. You must configure the same key on the
TACACS+ daemon for encryption to be successful.
tacacs-server host hostname [port integer] [timeout
integer] [key string]
3. Enable AAA.
aaa new-model
4. (Optional) Define the AAA server-group with a group name.
This command puts the access point in a server group subconfiguration
mode.