AAA via TACACS in Cisco

Assume that the Cisco TACACS server "Cisco Secure ACS+" is running in a Win2K3 server @ 172.16.1.11 and a user "safeer" is added in it.

First enable AAA in the router.

R1(config)#aaa new-model

Configure the authentication method.
R1(config)#aaa authentication login tac_access group tacacs+ local
R1(config)#aaa authentication login default local

Configure the tacas client to connect to server.

R1(config)#tacacs-server host 172.16.1.11 key keep_IT_secret

The problem with just enabling AAA new-model is that if you don't have local authentication configured as last login option with at least one local user-name password, you take the risk of locking yourself out of the router.

R1(config)#username jayesh password jayesh123

Now configure your terminal lines for aaa authenticated login. On your console and auxiliary lines, it is better to configure local authentication alone

R1(config)#line console 0
R1(config-line)#login authentication default
R1(config-line)#exit
R1(config)#line aux 0
R1(config-line)#login authentication default
R1(config-line)#exit
R1(config)#line vty 0 4
R1(config-line)#login authentication tac_access
R1(config-line)#end
Now save your configuration
R1#copy run start

From R2
R2>ssh -l safeer 192.168.2.1