AmpCon™-DC supports integrating with the Access Controller Access Control System (TACACS+) server to do authentication and authorization for the AmpCon-DC login users.
In addition to using local users (global users or group users), you can also enable the TACACS+ integration to manage user access.
Before you begin
You can configure at most two TACACS+ servers on the AmpCon-DC server. One is the primary and active server, while the other one is the secondary server, which is used for backup.
You can designate authorization levels by using the parameter priv-lvl on the TACACS+ server, which will be sent in the TACACS+ authorization response. The priv-lvl is mapped to one of four user role levels: Readonly, Operator, Admin and Superadmin. You can find the sample configuration of authorization level on TACACS+ server in the xx section.
If both TACACS+ servers are unreachable, you can use local users (global user or group user) to log in to the AmpCon-DC UI.
AmpCon-DC sends authorization requests with “Arg[0]” service=AmpCon-DC. On the TACACS+ server, you need to set the value of the parameter “service=AmpCon-DC” to process the authorization request of AmpCon-DC users.
Procedure
To enable the TACACS+ integration, follow these steps:
In the AmpCon-DC UI, click System > User management.
Click TACACS+ Settings.
Click Enable to activate theTACACS+ service.
In the pop-up window, enter the following information:
Enable: Enable or disable TACACS+ authentication and authorization
Primary Server IP: The IP address of the primary TACACS+ server
Secondary Server IP: Optional. The IP address of the backup TACACS+ server
Server Key: The shared key of TACACS+.
The value of the Server Key field needs to be the same as the shared key of the primary and secondary TACACS+ servers. The shared key on both TACACS+ servers needs to be the same.
Session Timeout: The TACACS+ connection timeout in seconds
Auth Protocol: The authentication protocol type of TACACS+ including ASCII, PAP or CHAP
TACACS+ User Level Mapping: The mapping ranges for TACACS+ authorization. The configuration page displays the default mapping values. You can configure a custom range for mapping values. The values are integers that range from 0 to15.
Add Comment