Courseiva
AAATACACS Config

address ipv4 [ip]

Configures the IPv4 address of a TACACS+ server for AAA authentication, authorization, and accounting.

Definition: address ipv4 [ip] is a Cisco IOS tacacs config command. Configures the IPv4 address of a TACACS+ server for AAA authentication, authorization, and accounting.

Overview

The `address ipv4 [ip]` command, used in TACACS+ configuration mode, specifies the IPv4 address of a TACACS+ server that the router will use for AAA (Authentication, Authorization, and Accounting) services. This command is essential for integrating Cisco devices with a centralized TACACS+ server, which provides robust security management by controlling who can access the network (authentication), what they can do (authorization), and logging their actions (accounting). TACACS+ is a Cisco-proprietary protocol that encrypts the entire packet body, offering better security than RADIUS for administrative access.

Network engineers reach for this command when deploying AAA on routers and switches to manage device access centrally, rather than maintaining local username databases on each device. It is typically used in conjunction with `tacacs-server host` commands in global configuration mode, but the `address ipv4` command is specifically used within a TACACS+ server group defined under `aaa group server tacacs+`. This allows grouping multiple TACACS+ servers for redundancy and load balancing.

The command is entered after creating a TACACS+ server group and entering its configuration mode. It directly impacts the running configuration by adding the server IP to the group, and the change takes effect immediately. Privilege level 15 (enable mode) is required to configure this command.

Understanding this command is crucial for CCNA and CCNP candidates as AAA is a core topic in security and network management. It fits into the broader workflow of securing network devices: first, enable AAA globally with `aaa new-model`; second, define TACACS+ server groups; third, configure authentication, authorization, and accounting methods using these groups; and finally, apply them to login, exec, or commands. Without specifying the server address, the group is empty and cannot be used.

Common mistakes include forgetting to enter TACACS+ server group configuration mode or using the wrong IP address. The command does not produce any output; it silently updates the configuration. It is important to note that the TACACS+ server must be reachable and configured correctly on the server side for AAA to work.

This command is a building block for a secure, scalable network access control solution.

Syntax·TACACS Config
address ipv4 [ip]

When to Use This Command

  • Pointing to a primary TACACS+ server for network device authentication
  • Adding a backup TACACS+ server for redundancy in AAA configurations
  • Configuring multiple TACACS+ servers for load balancing authentication requests
  • Replacing an old TACACS+ server IP with a new one during server migration

Parameters

ParameterSyntaxDescription
ipA.B.C.DThe IPv4 address of the TACACS+ server. This must be a valid unicast IP address. Common mistakes include using a broadcast or multicast address, or an IP that is not reachable from the device. Ensure the server is configured to accept TACACS+ connections from the router.

Command Examples

Configure a single TACACS+ server

address ipv4 192.168.1.100
tacacs-server host 192.168.1.100

The command sets the IPv4 address of the TACACS+ server to 192.168.1.100. The output confirms the server is added to the configuration.

Configure multiple TACACS+ servers with different keys

address ipv4 10.0.0.1 key MySecretKey
tacacs-server host 10.0.0.1
 key MySecretKey

The first line sets the server IP to 10.0.0.1. The second line assigns a shared secret key 'MySecretKey' for that server. The output shows both lines in the running config.

Understanding the Output

The command does not produce a direct output; instead, it modifies the running configuration. To verify, use 'show running-config | include tacacs-server'. The output will list all configured TACACS+ servers with their IP addresses and optional keys.

Each server appears as 'tacacs-server host <ip-address>'. If a key is configured, it appears on the next line indented. Ensure the IP is reachable and the key matches the server.

Missing or mismatched keys cause authentication failures.

Configuration Scenarios

Configure a TACACS+ Server Group for Administrative Access

A network administrator wants to centralize authentication for router and switch access using a TACACS+ server at 192.168.1.100. This scenario creates a server group and assigns the server IP.

Topology

R1---Management Network---TACACS+ Server (192.168.1.100)

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Enable AAA new model: aaa new-model
  3. 3.Step 3: Create a TACACS+ server group: aaa group server tacacs+ MYGROUP
  4. 4.Step 4: Enter server group configuration mode (automatically entered): server-private 192.168.1.100
  5. 5.Step 5: Specify the IPv4 address: address ipv4 192.168.1.100
  6. 6.Step 6: Exit and configure authentication: aaa authentication login default group MYGROUP local
  7. 7.Step 7: Apply to lines: line vty 0 4, login authentication default
Configuration
! Full IOS config block
Router(config)# aaa new-model
Router(config)# aaa group server tacacs+ MYGROUP
Router(config-sg-tacacs+)# server-private 192.168.1.100
Router(config-sg-tacacs+)# address ipv4 192.168.1.100
Router(config-sg-tacacs+)# exit
Router(config)# aaa authentication login default group MYGROUP local
Router(config)# line vty 0 4
Router(config-line)# login authentication default

Verify: Use `show aaa servers` to verify the server is configured. Look for the server IP under the TACACS+ group. Expected output includes the server IP and status.

Watch out: A common mistake is forgetting to use the `server-private` command before `address ipv4`. The `address ipv4` command is only valid within a server group configuration, and the server must first be defined as private.

Add a Second TACACS+ Server for Redundancy

To ensure high availability, a second TACACS+ server at 10.10.10.5 is added to the existing group MYGROUP. This scenario shows adding an additional server to the same group.

Topology

R1---Management Network---TACACS+ Server1 (192.168.1.100) and Server2 (10.10.10.5)

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Enter the existing TACACS+ server group: aaa group server tacacs+ MYGROUP
  3. 3.Step 3: Add the second server: server-private 10.10.10.5
  4. 4.Step 4: Specify its IPv4 address: address ipv4 10.10.10.5
  5. 5.Step 5: Exit and verify
Configuration
! Full IOS config block
Router(config)# aaa group server tacacs+ MYGROUP
Router(config-sg-tacacs+)# server-private 10.10.10.5
Router(config-sg-tacacs+)# address ipv4 10.10.10.5
Router(config-sg-tacacs+)# end

Verify: Use `show aaa servers` to see both servers listed under the group. Also use `show running-config | section aaa` to confirm the configuration.

Watch out: Ensure the second server IP is reachable and that the TACACS+ key is configured for each server using the `key` command under the server group. Without a matching key, authentication will fail.

Troubleshooting with This Command

When troubleshooting TACACS+ authentication issues, the `address ipv4` command itself is not directly used for diagnosis, but verifying that the correct server IP is configured is a critical first step. Begin by checking the running configuration with `show running-config | include aaa group server` to list all TACACS+ server groups. Then, examine the specific group with `show running-config | section aaa group server tacacs+ MYGROUP` to confirm the server IPs.

Healthy output shows the correct IP addresses under each `server-private` entry. If the IP is missing or incorrect, authentication will fail because the router does not know which server to contact. Common symptoms include login failures with 'authentication failed' messages or AAA server timeouts.

Use `debug aaa authentication` and `debug tacacs` to see which server the router is trying to reach. The debug output will show the server IP being contacted; if it shows 0.0.0.0 or an unexpected IP, the `address ipv4` command may be misconfigured. Also, use `test aaa group MYGROUP username password` to test authentication directly.

If the test fails, check connectivity to the server IP using `ping` from the router. If the ping succeeds but authentication fails, verify the TACACS+ key and server configuration. Another useful command is `show aaa servers`, which displays the status of all configured AAA servers, including TACACS+ servers.

Look for the 'current state' field; it should show 'alive' or 'up'. If it shows 'dead', the router has marked the server as unreachable. This could be due to incorrect IP address, network issues, or server not responding.

To correlate, check the server's configuration and logs. If the server IP is correct but the server is dead, consider increasing the timeout or retransmit count with the `timeout` and `retransmit` commands under the server group. In summary, the `address ipv4` command is foundational; misconfiguration here breaks all AAA services relying on that server.

Always verify the IP address matches the actual TACACS+ server and that the server is reachable and properly configured.

CCNA Exam Tips

1.

CCNA exam may test that 'address ipv4' is used under TACACS config mode, not global config.

2.

Remember that the key must be configured separately; the address command alone does not set a key.

3.

You can configure multiple TACACS+ servers; the router tries them in order of configuration.

4.

The command 'tacacs-server host' in global config is an older method; CCNA focuses on the newer TACACS config mode.

Common Mistakes

Forgetting to enter TACACS config mode before using 'address ipv4' — results in invalid command error.

Configuring the IP address but not setting a key — causes authentication to fail silently.

Using the wrong IP address or a non-reachable server — leads to AAA timeouts and fallback to local authentication.

address ipv4 [ip] vs key [shared-secret]

Both commands are configured under the TACACS+ server configuration mode and are essential for AAA operations, but they serve distinct roles: address ipv4 sets the server IP, while key defines the authentication secret. They are often considered together because a TACACS+ server requires both to function.

Aspectaddress ipv4 [ip]key [shared-secret]
ScopeConfigures the IPv4 address of a single TACACS+ serverConfigures the shared secret for a TACACS+ server
Syntaxaddress ipv4 <ip> – requires a valid IPv4 addresskey <shared-secret> – expects an alphanumeric string
ModeTACACS Config (entered via 'tacacs-server host <name>')Same TACACS Config submode
PersistenceSaved in running-config under the TACACS server host blockSaved in running-config; 'show running-config | section tacacs' displays both
DependencyNeeded to define a server; key is also required for successful authenticationMust be present; otherwise TACACS+ packets are rejected
Typical useSet the server host IP when adding a new TACACS+ serverConfigure the pre-shared key matching the TACACS+ server

Use address ipv4 [ip] when you need to specify the IP address of a TACACS+ server for AAA communication.

Use key [shared-secret] when you need to define the authentication key that matches the TACACS+ server's secret.

Platform Notes

In IOS-XE, the `address ipv4` command syntax is identical to classic IOS. However, IOS-XE may use the `server-private` command differently; in some versions, you can specify the IP directly with `server-private <ip>` without needing the `address ipv4` subcommand. For example, `server-private 192.168.1.100` automatically sets the address.

The `address ipv4` command is still available for explicit configuration. In NX-OS, the equivalent command is `tacacs-server host <ip>` under global configuration, and server groups are configured with `aaa group server tacacs+ <name>` followed by `server <ip>`. NX-OS does not use the `address ipv4` subcommand; instead, the server IP is specified directly in the `server` command.

For ASA, TACACS+ is configured using `tacacs-server host <ip> <key>` in global configuration mode, and server groups are not used; instead, AAA server groups are created with `aaa-server <name> protocol tacacs+` and then `server <ip>`. The ASA does not have an `address ipv4` command. In IOS-XR, TACACS+ configuration is similar to IOS but uses `tacacs-server host <ip>` and `aaa group server tacacs+ <name>` with `server <ip>`.

The `address ipv4` command is not present in IOS-XR. Across IOS versions (12.x, 15.x, 16.x), the command behavior is consistent, but the context (server group configuration mode) may require entering via `server-private` first. Always check the specific version documentation for any syntax changes.

Related Commands

aaa authentication login default group radius local

Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

key [shared-secret]

Configures the shared secret key used for TACACS+ authentication between the Cisco device and the TACACS+ server.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions