In which configuration mode is tacacs server [name] used?

The tacacs server [name] command is entered in Global Config mode on Cisco IOS devices.

AAAGlobal Config

tacacs server [name]

Defines a TACACS+ server with a name and enters TACACS server configuration mode to set parameters like key, timeout, and port for AAA authentication.

Definition: tacacs server [name] is a Cisco IOS global config command. Defines a TACACS+ server with a name and enters TACACS server configuration mode to set parameters like key, timeout, and port for AAA authentication.

Overview

The `tacacs server [name]` command is a fundamental building block for configuring TACACS+ authentication, authorization, and accounting (AAA) on Cisco IOS devices. TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-proprietary protocol that provides centralized authentication, authorization, and accounting for network devices. Unlike RADIUS, which combines authentication and authorization in a single packet, TACACS+ separates these functions, offering granular control over user permissions.

This command defines a TACACS+ server by assigning it a name and entering TACACS server configuration mode, where you can set parameters such as the server's IP address or hostname, the shared secret key, timeout values, and port number. The command is essential for any network that requires secure, centralized management of administrative access to routers, switches, firewalls, and other infrastructure devices. Without TACACS+, network administrators would have to manage local usernames and passwords on each device individually, which is impractical in large or dynamic environments.

The `tacacs server` command is typically used in conjunction with AAA configuration: you first define one or more TACACS+ servers, then create an AAA authentication list that references those servers. For example, you might configure AAA authentication for login (console and VTY lines) to use a TACACS+ server group, with a local fallback if the server is unreachable. The command is entered in global configuration mode and requires privilege level 15 (enable mode).

Once executed, the prompt changes to `config-tacacs-server` mode, where you can specify the server's IP address using the `address ipv4` or `address ipv6` subcommand, the shared secret with `key`, the timeout with `timeout`, and the port with `port`. The server name is a local identifier; it does not need to match the DNS name of the server. Common mistakes include forgetting to configure the key (which must match the key on the TACACS+ server), using the wrong port (default is 49), or not setting a timeout appropriate for the network latency (default is 5 seconds).

The command is supported in IOS, IOS-XE, and IOS-XR, though syntax may vary slightly. In NX-OS, the equivalent is `tacacs-server host` with different subcommands. The `tacacs server` command is also used in conjunction with `aaa group server tacacs+` to create server groups for redundancy and load balancing.

When troubleshooting AAA issues, verifying the TACACS+ server configuration is a critical first step. The command's output is stored in the running configuration and can be viewed with `show running-config | section tacacs`. It is important to note that the server definition does not test connectivity; you must use `test aaa` or debug commands to verify communication.

Overall, the `tacacs server` command is a cornerstone of secure network device management, enabling centralized control and audit trails for administrative actions.

Syntax·Global Config

tacacs server [name]

When to Use This Command

Configuring a primary TACACS+ server for network device authentication in a corporate network.
Adding a backup TACACS+ server for redundancy when the primary server is unreachable.
Setting up TACACS+ for centralized authentication, authorization, and accounting (AAA) on Cisco routers and switches.
Configuring multiple TACACS+ servers with different keys for different administrative domains.

Parameters

Parameter	Syntax	Required	Description
name	WORD	Required	A locally significant name for the TACACS+ server. This name is used to reference the server in other AAA commands, such as in a server group. It does not have to match the server's hostname or DNS name. Common practice is to use a descriptive name like 'TACACS1' or 'ACS-Primary'. Avoid spaces or special characters.

Command Examples

Basic TACACS+ Server Configuration

tacacs server TACACS-SERVER-1
 address ipv4 192.168.1.100
 key cisco123
 timeout 10
 single-connection
 exit

Router(config)# tacacs server TACACS-SERVER-1
Router(config-server-tacacs)# address ipv4 192.168.1.100
Router(config-server-tacacs)# key cisco123
Router(config-server-tacacs)# timeout 10
Router(config-server-tacacs)# single-connection
Router(config-server-tacacs)# exit
Router(config)#

The command enters TACACS server configuration mode for server named 'TACACS-SERVER-1'. 'address ipv4' sets the server IP to 192.168.1.100. 'key' sets the shared secret to 'cisco123'. 'timeout' sets the wait time to 10 seconds before considering the server unreachable. 'single-connection' enables persistent TCP connection for performance. 'exit' returns to global config.

Configuring a Backup TACACS+ Server

tacacs server TACACS-BACKUP
 address ipv4 10.0.0.1
 key backupkey456
 port 49
 timeout 5
 exit

Router(config)# tacacs server TACACS-BACKUP
Router(config-server-tacacs)# address ipv4 10.0.0.1
Router(config-server-tacacs)# key backupkey456
Router(config-server-tacacs)# port 49
Router(config-server-tacacs)# timeout 5
Router(config-server-tacacs)# exit
Router(config)#

Defines a backup TACACS+ server at 10.0.0.1 with key 'backupkey456'. 'port 49' explicitly sets the TACACS+ port (default is 49). 'timeout 5' sets a shorter timeout for faster failover. This server will be used if the primary is unreachable.

Understanding the Output

The 'tacacs server [name]' command does not produce a direct output; it enters a configuration submode. The output shown is the CLI prompt changes indicating you are in TACACS server configuration mode. The key fields to verify are the server IP address (must be reachable), the shared secret key (must match the server), timeout (should be adequate for network latency), and the port (default 49, change only if server uses non-standard port).

Use 'show tacacs' to verify the server status and statistics.

Configuration Scenarios

Configure a Single TACACS+ Server for AAA Authentication

A network administrator needs to centralize authentication for device access. They have a TACACS+ server at 192.168.1.100 with a shared secret key 'Cisco123'. They want to authenticate console and VTY lines using this server, with local authentication as a fallback.

Topology

R1 --- Management Network --- TACACS+ Server (192.168.1.100)

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Define the TACACS+ server: tacacs server TACACS-SERVER
3.Step 3: Set the server IP address: address ipv4 192.168.1.100
4.Step 4: Set the shared secret key: key Cisco123
5.Step 5: (Optional) Set timeout to 10 seconds: timeout 10
6.Step 6: (Optional) Set port to 49 (default): port 49
7.Step 7: Exit TACACS server configuration mode: exit
8.Step 8: Create an AAA authentication list: aaa authentication login default group tacacs+ local
9.Step 9: Apply the authentication list to lines: line console 0, login authentication default; line vty 0 4, login authentication default

Configuration

! Define TACACS+ server
tacacs server TACACS-SERVER
 address ipv4 192.168.1.100
 key Cisco123
 timeout 10
 port 49
!
! Configure AAA authentication
aaa new-model
aaa authentication login default group tacacs+ local
!
! Apply to lines
line console 0
 login authentication default
line vty 0 4
 login authentication default

Verify: Use 'show running-config | section tacacs' to verify the server configuration. Use 'test aaa group tacacs+ Cisco123 legacy' to test authentication (replace 'Cisco123' with a test username). Expected output: 'User was successfully authenticated.'

Watch out: A common mistake is forgetting to issue the 'aaa new-model' command before configuring AAA. Without it, the AAA commands are not accepted.

Configure Multiple TACACS+ Servers with a Server Group for Redundancy

An enterprise network requires high availability for authentication. Two TACACS+ servers are deployed: primary at 10.10.10.1 and backup at 10.10.10.2. The administrator wants to create a server group and use it for authentication, with local fallback.

Topology

R1 --- Management Network --- Primary TACACS+ (10.10.10.1) --- Backup TACACS+ (10.10.10.2)

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Define the first TACACS+ server: tacacs server TACACS-PRIMARY
3.Step 3: Set its IP and key: address ipv4 10.10.10.1, key SecretKey1
4.Step 4: Exit and define the second server: tacacs server TACACS-BACKUP
5.Step 5: Set its IP and key: address ipv4 10.10.10.2, key SecretKey2
6.Step 6: Create a server group: aaa group server tacacs+ MY-GROUP
7.Step 7: Add servers to the group: server name TACACS-PRIMARY, server name TACACS-BACKUP
8.Step 8: Create an AAA authentication list using the group: aaa authentication login default group MY-GROUP local
9.Step 9: Apply to lines as before.

Configuration

! Define TACACS+ servers
tacacs server TACACS-PRIMARY
 address ipv4 10.10.10.1
 key SecretKey1
!
tacacs server TACACS-BACKUP
 address ipv4 10.10.10.2
 key SecretKey2
!
! Create server group
aaa group server tacacs+ MY-GROUP
 server name TACACS-PRIMARY
 server name TACACS-BACKUP
!
! Configure AAA authentication
aaa new-model
aaa authentication login default group MY-GROUP local
!
! Apply to lines
line console 0
 login authentication default
line vty 0 4
 login authentication default

Verify: Use 'show aaa servers' to see the status of each TACACS+ server. The output will show 'current state' as 'UP' or 'DEAD'. Use 'debug tacacs' to see authentication attempts and which server is used.

Watch out: If the servers are in different subnets, ensure IP routing is working. Also, the server names in the group must match exactly the names defined with 'tacacs server'.

Troubleshooting with This Command

When troubleshooting TACACS+ authentication issues, the `tacacs server` configuration is the starting point. Healthy output from `show running-config | section tacacs` should display the server name, IP address, and key (though the key is hidden as 'key 7 xxxxxx'). A common problem indicator is a missing or incorrect key; if the key does not match the TACACS+ server, authentication will fail with 'authentication failed' messages.

Another issue is an incorrect IP address or port; the default port is 49, but if the server uses a different port, it must be specified. Timeout values that are too low can cause failures in high-latency networks; the default is 5 seconds, but increasing to 10 or 15 seconds may help. To diagnose, first verify connectivity to the TACACS+ server using `ping` from the router.

If ping fails, check routing and ACLs. Next, use `test aaa group tacacs+ <username> <password> legacy` to simulate authentication. A successful test returns 'User was successfully authenticated.' A failure may indicate a key mismatch or server unreachable.

Use `debug tacacs` to see detailed packet exchanges; look for 'TACACS+ server 192.168.1.100:49 responded with FAILURE' or 'no response'. If the server is not responding, check the server's logs and ensure it is configured to accept requests from the router's IP. Another useful command is `show aaa servers`, which shows the state of each TACACS+ server (UP/DEAD) and the number of successful/failed transactions.

If the server is marked DEAD, the router has stopped sending requests to it; you can clear this with `clear aaa server` or by waiting for the dead-time to expire. Also, ensure that `aaa new-model` is enabled; without it, AAA commands are not processed. Correlate debug output with the server's logs to pinpoint mismatches.

For example, if the router sends a packet but the server logs show 'invalid key', the key is wrong. If the server logs show 'authentication success' but the router still denies access, check the authorization configuration. Remember that TACACS+ separates authentication and authorization; even if authentication succeeds, authorization may fail if the user is not permitted to access the device.

Finally, check that the authentication list is applied to the correct lines (console, VTY, AUX). A common oversight is applying the list only to VTY lines but not to the console, causing console access to use the default (local) authentication, which may not be intended. By following this systematic approach, most TACACS+ issues can be resolved quickly.

CCNA Exam Tips

CCNA exam tip: Remember that 'tacacs server' is used for TACACS+ (not RADIUS). TACACS+ uses TCP port 49 by default and encrypts the entire packet.

CCNA exam tip: The 'single-connection' command is optional but improves performance by reusing a single TCP connection; know that it is a TACACS+ specific feature.

CCNA exam tip: You must configure a TACACS+ server group (e.g., 'aaa group server tacacs+') and apply it under 'aaa authentication login' to use the defined servers.

CCNA exam tip: The key must be identical on both the Cisco device and the TACACS+ server; a mismatch causes authentication failures.

Common Mistakes

Mistake 1: Forgetting to configure the key on both the device and the TACACS+ server, causing authentication to fail.

Mistake 2: Using the wrong IP address or port; verify connectivity with 'test aaa' or 'debug tacacs'.

Mistake 3: Not creating a server group and applying it to AAA authentication; the server definition alone does not enable TACACS+ authentication.

tacacs server [name] vs aaa new-model

These commands are commonly confused because both are necessary for TACACS+ authentication, but they operate at different levels: aaa new-model enables the AAA framework globally, while tacacs server defines a specific server instance and enters its configuration mode.

Aspect	tacacs server [name]	aaa new-model
Scope	Global configuration mode	Global configuration mode
Configuration mode entered	Enters TACACS server configuration mode	No sub-mode entered
Persistence	Must be configured for each TACACS+ server	Must be configured before any AAA commands
Precedence	Depends on aaa new-model being enabled	Required before tacacs server commands
Typical use	Define server parameters (key, timeout, port)	Enable AAA security services on the device

Use tacacs server [name] when you need to define a specific TACACS+ server and its parameters like key, timeout, and port.

Use aaa new-model when you need to enable AAA security services on the device as a prerequisite for any AAA configuration.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the `tacacs server` command syntax is identical to classic IOS. However, IOS-XE uses a different underlying architecture, and the `show aaa servers` command may display additional fields like 'Server Port' and 'Dead Time'. In NX-OS (e.g., Nexus 9000, 7000), the equivalent command is `tacacs-server host <ip-address>` with subcommands like `key`, `timeout`, and `port`.

NX-OS does not use the `tacacs server` naming approach; instead, you define the server directly with its IP address. For example: `tacacs-server host 192.168.1.100 key Cisco123 timeout 10`. NX-OS also uses `aaa group server tacacs+` to create server groups, but the server is referenced by IP, not by name.

In ASA (Adaptive Security Appliance), the command is `tacacs-server host <ip-address> key <key>` in global configuration mode, and AAA is configured with `aaa authentication` commands. ASA does not support named TACACS+ servers. In IOS-XR (e.g., ASR 9000, NCS 5500), the command is `tacacs-server host <ip-address>` with subcommands, similar to NX-OS.

IOS-XR also uses `aaa authentication` and `aaa authorization` but with different syntax. For example: `tacacs-server host 10.10.10.1 port 49 timeout 5 key 7 <encrypted-key>`. Note that IOS-XR uses a different encryption method for keys.

Between IOS versions, the `tacacs server` command was introduced in IOS 12.3(2)T and later. In earlier versions, you had to use `tacacs-server host` directly. The `tacacs server` naming approach is preferred because it allows multiple servers with the same IP but different keys (though uncommon).

In IOS 15.x and 16.x, the command remains unchanged. Always check the specific platform documentation, as some features like dead-time configuration may differ.

Related Commands

aaa authentication login default group radius local

Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions