In which configuration mode is key [shared-secret] used?

The key [shared-secret] command is entered in TACACS Config mode on Cisco IOS devices.

AAATACACS Config

key [shared-secret]

Configures the shared secret key used for TACACS+ authentication between the Cisco device and the TACACS+ server.

Definition: key [shared-secret] is a Cisco IOS tacacs config command. Configures the shared secret key used for TACACS+ authentication between the Cisco device and the TACACS+ server.

Overview

The `key [shared-secret]` command in TACACS+ configuration mode is used to set the shared secret key that authenticates communication between a Cisco device and a TACACS+ server. This key is a pre-shared string that both the device and the server must know; it is used to encrypt and validate TACACS+ packets, ensuring that only authorized servers can interact with the device for authentication, authorization, and accounting (AAA). TACACS+ is a Cisco-proprietary AAA protocol that separates authentication, authorization, and accounting functions, providing granular control over network access.

The shared secret is critical because without it, the device will reject packets from the TACACS+ server, and vice versa. This command is typically used when configuring AAA for device administration (e.g., SSH, console, enable access) or for network access (e.g., 802.1X, VPN). Alternatives include RADIUS, which uses a shared secret as well but encrypts only the password in the access-request packet, whereas TACACS+ encrypts the entire body of the packet.

The `key` command is entered after specifying the TACACS+ server with `tacacs server` command in global configuration mode. It is important to note that the key is stored in the running configuration in plain text unless the `service password-encryption` command is enabled, which encrypts it using a weak Cisco Type 7 algorithm. For stronger security, use Type 6 encryption (master key) or Type 8/9 (PBKDF2/scrypt) if supported.

The command requires privileged EXEC mode (enable) and affects the running configuration immediately; it must be saved to startup configuration with `copy running-config startup-config` to persist. The key length can be up to 128 characters and is case-sensitive. Common mistakes include using mismatched keys between the device and server, or forgetting to configure the key at all, which results in authentication failures.

This command is foundational for any TACACS+ deployment and is often one of the first steps after defining the server host and port.

Syntax·TACACS Config

key [shared-secret]

When to Use This Command

Setting up TACACS+ authentication for administrative access to network devices.
Configuring a shared secret for a new TACACS+ server added to the network.
Updating the shared secret when rotating keys for security compliance.
Troubleshooting TACACS+ authentication failures due to key mismatch.

Parameters

Parameter	Syntax	Required	Description
shared-secret	WORD (1-128 characters)	Required	The shared secret key used to authenticate the TACACS+ server. It must match the key configured on the TACACS+ server. The key can contain any printable ASCII characters and is case-sensitive. Common mistakes include leading or trailing spaces, which are included in the key, and using special characters that may require escaping in some contexts. Ensure the key is identical on both ends.

Command Examples

Configure TACACS+ shared secret key

key Cisco123

No output is displayed upon successful configuration. The command sets the shared secret to 'Cisco123' for the TACACS+ server.

Verify TACACS+ key configuration

show running-config | include tacacs server

tacacs server TACACS_SERVER
 address ipv4 192.168.1.100
 key Cisco123

The output shows the TACACS+ server configuration with the key 'Cisco123' under the server definition. The key is displayed in plaintext if encryption is not enabled.

Understanding the Output

The 'key' command itself produces no output. To verify the configured key, use 'show running-config | section tacacs' or 'show tacacs'. The key appears in plaintext unless 'service password-encryption' is enabled, in which case it shows as encrypted (e.g., 'key 7 0822455D0A16').

Ensure the key matches exactly on both the device and the TACACS+ server; mismatched keys cause authentication failures. A missing key or incorrect key will result in 'Authentication failed' messages in logs.

Configuration Scenarios

Configure TACACS+ for Device Administration

A network administrator wants to centralize authentication for SSH and console access to a Cisco router using a TACACS+ server at 192.168.1.100. The shared secret is 'Cisco123'.

Topology

Router(Gi0/0)---192.168.1.0/24---(eth0)TACACS+ Server

Steps

1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
2.Step 2: Define the TACACS+ server: Router(config)# tacacs server TACACS-Server
3.Step 3: Specify the server IP address: Router(config-server-tacacs)# address ipv4 192.168.1.100
4.Step 4: Set the shared secret key: Router(config-server-tacacs)# key Cisco123
5.Step 5: Exit server configuration: Router(config-server-tacacs)# exit
6.Step 6: Enable AAA globally: Router(config)# aaa new-model
7.Step 7: Configure authentication for login: Router(config)# aaa authentication login default group tacacs+ local
8.Step 8: Apply authentication to lines: Router(config)# line vty 0 4, Router(config-line)# login authentication default, Router(config-line)# exit
9.Step 9: (Optional) Enable password encryption: Router(config)# service password-encryption

Configuration

! Full IOS config block
tacacs server TACACS-Server
 address ipv4 192.168.1.100
 key Cisco123
!
aaa new-model
aaa authentication login default group tacacs+ local
!
line vty 0 4
 login authentication default

Verify: Use 'show tacacs' to verify the server is configured and the key is set. Expected output includes the server IP and 'Key' field (encrypted if service password-encryption is enabled). Also test by initiating an SSH session and authenticating with a TACACS+ user.

Watch out: If the key contains special characters like '?' or spaces, you must enter it correctly; the CLI may interpret '?' as a help request. Use Ctrl+V before '?' to escape. Also, ensure the key is exactly the same on the server, including case.

Configure Multiple TACACS+ Servers with Different Keys

A company has two TACACS+ servers for redundancy: primary at 10.0.0.1 with key 'Key1' and secondary at 10.0.0.2 with key 'Key2'. The device should try the primary first.

Topology

Router(Gi0/0)---10.0.0.0/24---(eth0)Primary TACACS+ (10.0.0.1)
Router(Gi0/1)---10.0.0.0/24---(eth0)Secondary TACACS+ (10.0.0.2)

Steps

1.Step 1: Enter global configuration mode.
2.Step 2: Define the primary server: Router(config)# tacacs server Primary, Router(config-server-tacacs)# address ipv4 10.0.0.1, Router(config-server-tacacs)# key Key1, Router(config-server-tacacs)# exit
3.Step 3: Define the secondary server: Router(config)# tacacs server Secondary, Router(config-server-tacacs)# address ipv4 10.0.0.2, Router(config-server-tacacs)# key Key2, Router(config-server-tacacs)# exit
4.Step 4: Configure AAA authentication to use the tacacs+ group: Router(config)# aaa new-model, Router(config)# aaa authentication login default group tacacs+ local
5.Step 5: Create a server group (optional but recommended for ordering): Router(config)# aaa group server tacacs+ TACACS-Group, Router(config-sg-tacacs)# server name Primary, Router(config-sg-tacacs)# server name Secondary, Router(config-sg-tacacs)# exit
6.Step 6: Use the group in authentication: Router(config)# aaa authentication login default group TACACS-Group local

Configuration

! Full IOS config block
tacacs server Primary
 address ipv4 10.0.0.1
 key Key1
!
tacacs server Secondary
 address ipv4 10.0.0.2
 key Key2
!
aaa new-model
aaa group server tacacs+ TACACS-Group
 server name Primary
 server name Secondary
!
aaa authentication login default group TACACS-Group local

Verify: Use 'show tacacs' to see both servers and their keys (encrypted). Use 'debug tacacs' to see which server is contacted. Expected: primary is tried first; if unreachable, secondary is used.

Watch out: If the keys are different, ensure each server's key matches exactly. A common mistake is to assume the same key for all servers. Also, the order of servers in the group determines the fallback order.

Troubleshooting with This Command

When troubleshooting TACACS+ authentication issues, the `key` command is often the first suspect. A healthy configuration shows the server with a key set (encrypted if `service password-encryption` is enabled) when using `show tacacs`. The output includes fields like 'Server: 192.168.1.100', 'Port: 49', 'Timeout: 5', 'Key: 7 0822455D0A16' (encrypted).

If the key is missing or mismatched, authentication will fail with errors like 'Authentication failed' or 'No server response'. Focus on the 'Key' field: if it shows 'Key: ' with no value, the key is not configured. If the key is present but authentication fails, use `debug tacacs` to see detailed packet exchanges.

Look for 'TACACS+ packet rejected' or 'Invalid authen response' which often indicates key mismatch. Also check the server logs for 'Invalid shared secret'. A step-by-step diagnostic flow: 1) Verify the key is configured on the device with `show run | section tacacs`. 2) Confirm the key matches the server exactly (case-sensitive, no extra spaces). 3) Test connectivity to the server using `telnet <server-ip> 49` or `ping`. 4) Enable `debug tacacs` and attempt authentication; look for 'TACACS+ authen: send packet' and 'TACACS+ authen: received packet'.

If the packet is rejected, the key is likely wrong. 5) Check the server's configuration for the correct key and ensure the server is listening on TCP 49. 6) If using multiple servers, verify each server's key individually. Correlate `show tacacs` output with `debug tacacs` to identify which server is being contacted. Common symptoms: 'AAA authentication failure' with 'Invalid password' even though the password is correct, or 'Timeout' errors.

The former suggests key mismatch; the latter suggests network issues or server unavailability. Remember that the key is stored in plain text in the running config unless encryption is enabled, so always use `service password-encryption` to obscure it. For stronger security, consider using Type 6 encryption with a master key.

CCNA Exam Tips

CCNA exam tip: The 'key' command is configured under 'tacacs server' configuration mode, not global config.

CCNA exam tip: The shared secret must match exactly on both the router and the TACACS+ server; case-sensitive.

CCNA exam tip: Use 'show tacacs' to verify the server status and key encryption.

CCNA exam tip: Remember that 'service password-encryption' encrypts the key in the running config but does not affect authentication.

Common Mistakes

Mistake 1: Configuring the key under global config mode instead of TACACS server config mode — results in 'Invalid input detected' error.

Mistake 2: Typing the key with leading/trailing spaces — causes authentication failure due to mismatch.

Mistake 3: Forgetting to apply 'service password-encryption' — the key is stored in plaintext in the config.

key [shared-secret] vs aaa new-model

These two commands are commonly confused because both are fundamental to configuring TACACS+ authentication, yet they operate at different layers of the AAA framework. The 'aaa new-model' command enables the entire AAA subsystem globally, while 'key [shared-secret]' sets the shared secret for a specific TACACS+ server within that subsystem.

Aspect	key [shared-secret]	aaa new-model
Scope	Configures key for a single TACACS+ server (per-server basis)	Enables AAA globally on the entire device
Configuration mode	TACACS Config mode (entered via 'tacacs server ...')	Global configuration mode
Persistence	Must be reapplied if AAA is disabled or server is removed	Remains in running config until explicitly disabled ('no aaa new-model')
Precedence	Requires 'aaa new-model' to be active; otherwise ignored	Enables all AAA commands; must be present before any AAA config
Typical use	Setting the pre-shared key for TACACS+ server authentication	Activating AAA as the security framework for device access

Use key [shared-secret] when you have already enabled AAA and need to set the shared secret for a specific TACACS+ server to authenticate the device to that server.

Use aaa new-model when you need to enable AAA security services on the device as the prerequisite for all subsequent AAA configurations, including TACACS+.

Platform Notes

In IOS-XE, the `key` command syntax is identical to classic IOS. However, IOS-XE supports additional encryption options like `key encryption-type 6` for Type 6 encryption (requires a master key configured with `key config-key password-encrypt`). The output of `show tacacs` may include a 'Key Encryption' field indicating the encryption type.

In NX-OS, the equivalent command is `tacacs-server key <shared-secret>` under global configuration, not under a server definition. NX-OS uses a different AAA model: you define the key globally or per server using `tacacs-server host <ip> key <key>`. The `show tacacs-server` command displays the key (encrypted).

For ASA, the command is `tacacs-server key <shared-secret>` in global configuration mode, and you associate servers with `tacacs-server host <ip> key <key>`. ASA also supports `aaa-server` protocol tacacs+. In IOS-XR, TACACS+ is supported but configuration is done via the `aaa` configuration context: `tacacs-server host <ip> key <key>`.

The key command is not used under a server sub-mode; instead, it is part of the host definition. Behaviour differences: In older IOS versions (12.x), the `key` command was entered under `tacacs-server host` directly (e.g., `tacacs-server host 10.0.0.1 key Cisco123`). In 15.x and later, the preferred method is the `tacacs server` sub-mode.

The `service password-encryption` command works similarly across platforms, but NX-OS uses Type 7 encryption by default. Always check the specific platform documentation for exact syntax.

Related Commands

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions