Page Comparison

...

In addition to using local users (global users or group users), you can also enable the TACACS+ integration to manage user access.

...

Before You Begin

Before you enable the TACACS+ integration, read the following notes:

You can configure at most two TACACS+ servers on the AmpCon-DC server. One is the primary and active server, while the other one is the secondary server, which is used for backup. If you don’t need backup, no need to configure the secondary TACACS+ server.
You can designate authorization levels by using the parameter priv-lvl on the TACACS+ server. The priv-lvl configuration will be sent in the TACACS+ authorization response. The priv-lvl is mapped to one of four user local role levels: Readonly, Operator, Admin and Superadmin. You can find the sample configuration of authorization level on

For how to configure authorization levels on the TACACS+ server

...

, see the Sample Configuration of Authorization Level on TACACS+ Server (Linux tac_plus) section.

AmpCon-DC sends authorization requests with “Arg[0]” service=AmpCon-DC. On the TACACS+ server, you need to set the value of the parameter “service=AmpCon-DC” to process the authorization request of AmpCon-DC users.
If both TACACS+ servers are unreachable, you can use local users (global user or group user) to log in to the AmpCon-DC UI.

To enable the TACACS+ integration, follow these steps:

...

Parameter	Description
Enable	Enable or disable TACACS+ authentication and authorization.
Primary Server IP	The IP address of the primary TACACS+ server.
Secondary Server IP	Optional. The IP address of the backup TACACS+ server.
Server Key	The shared key of TACACS+. Note: The value of the Server Key field needs to be the same as the shared key of the primary and secondary TACACS+ servers. The shared key on both TACACS+ servers needs to be the same.
Session Timeout	The TACACS+ connection timeout in seconds.
Auth Protocol	The authentication protocol type of TACACS+ including ASCII, PAP or CHAP.
TACACS+ User Level Mapping	The mapping ranges for TACACS+ authorization. The configuration page displays the default mapping values. You can configure a custom range for mapping values. The values are integers that range from 0 to15. Notes: Don’t overlap any range with other ranges among different user levels. If the priv-lvl configuration of a user on the TACACS+ server is not found in a level-mapping configuration on AmpCon-DC, the user role level is mapped to Readonly.

For how to configure authorization levels on the TACACS+ server, see the following example:

user = leontest {
global = cleartext "abc"
service = AmpCon {
default attribute = permit
priv-lvl = 15
}
}

user = automation1 {
global = cleartext "automation"
service = AmpCon {
default attribute = permit
priv-lvl = 10
}
}

user = testtest {
global = cleartext "testtest"
service = AmpCon {
default attribute = permit
priv-lvl = 5
}
}

user = testpica8 {
global = cleartext "testpica8"
service = AmpCon {
default attribute = permit
priv-lvl = 1
}
}