配置Nexus Tacacs管理

一、設備拓撲：

N7K（mgmt0)----VMnet1-----ACS5.2

二、設備配置：
2.一、基礎配置
第一部分：N7K
interface mgmt0
vrf member management
ip address 10.0.0.101/24
測試連通性：
N7K-2# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
ping: sendto 10.0.0.1 64 chars, No route to host
^C
--- 10.0.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100.00% packet loss
N7K-2# ping 10.0.0.1 vrf management
PING 10.0.0.1 (10.0.0.1): 56 data bytes
64 bytes from 10.0.0.1: icmp_seq=0 ttl=63 time=0.677 ms
64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=0.524 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=0.952 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=0.843 ms
64 bytes from 10.0.0.1: icmp_seq=4 ttl=63 time=0.469 ms

--- 10.0.0.1 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 0.469/0.692/0.952 ms

 

第二部分：ACS5.2
ACS/admin# sho interface gigabitEthernet 0
eth0 Link encap:Ethernet HWaddr 00:0C:29:33:F9:EF
inet addr:10.0.0.102 Bcast:10.0.0.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe33:f9ef/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5735 errors:0 dropped:0 overruns:0 frame:0
TX packets:7979 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1319303 (1.2 MiB) TX bytes:8018911 (7.6 MiB)
Interrupt:177 Base address:0x2000

測試連通性：
ACS/admin# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=0.240 ms
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.190 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.207 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.185 ms

--- 10.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3016ms
rtt min/avg/max/mdev = 0.185/0.205/0.240/0.025 ms, pipe 2

ACS/admin#

 

2.二、保證N7K和ACS以前的連通性：
N7K-2# ping 10.0.0.102 vrf management
PING 10.0.0.102 (10.0.0.102): 56 data bytes
64 bytes from 10.0.0.102: icmp_seq=0 ttl=63 time=0.713 ms
64 bytes from 10.0.0.102: icmp_seq=1 ttl=63 time=0.564 ms
64 bytes from 10.0.0.102: icmp_seq=2 ttl=63 time=0.629 ms
64 bytes from 10.0.0.102: icmp_seq=3 ttl=63 time=0.654 ms
64 bytes from 10.0.0.102: icmp_seq=4 ttl=63 time=1.162 ms

--- 10.0.0.102 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 0.564/0.744/1.162 ms
N7K-2#

 

2.三、配置Tacacs
主要配置部分體現爲綠色配置，其餘部分爲默認或自動產生配置。
N7K-2# sho running-config tacacs+ all

!Command: show running-config tacacs+ all
!Time: Mon Sep 2 12:21:19 2019

version 6.1(1)
feature tacacs+

tacacs-server key 7 "Fewhg@123"
no ip tacacs source-interface
tacacs-server test username test password test idle-time 0
tacacs-server timeout 5
tacacs-server deadtime 0
tacacs-server host 10.0.0.102 port 49
tacacs-server host 10.0.0.102 test username test password test idle-time 0
aaa group server tacacs+ TACACS
　　server 10.0.0.102
　　use-vrf management
　　no source-interface

 

2.四、ACS配置
N7K-2這個名字不必定要和設備同樣，這裏爲了好分別！這只是定義設備的一個名字，主要是那個IP地址。

 

 

 

 

 

 

三、驗證

N7K-2# exit

*****************
Username: admin
Password: cisco
*****************
N7K-2 login: admin
Password: （這裏使用的是cisco，錯誤了！）
Login incorrect

*****************
Username: admin
Password: cisco
*****************
login: admin
Password: （這裏使用了AAA的帳戶，成功了！）
Last login: Mon Sep 2 12:03:31 UTC 2019 on ttyS0
Last login: Mon Sep 2 12:25:25 on ttyS0
Cisco NX-OS Software
Copyright (c) 2002-2012, Cisco Systems, Inc. All rights reserved.
NX-OS/Titanium software ("NX-OS/Titanium Software") and related
documentation, files or other reference materials ("Documentation")
are the proprietary property and confidential information of Cisco
Systems, Inc. ("Cisco") and are protected, without limitation,
pursuant to United States and International copyright and trademark
laws in the applicable jurisdiction which provide civil and criminal
penalties for copying or distribution without Cisco's authorization.
The use of NX-OS/Titanium Software and Documentation is strictly
limited to Cisco's internal use.

Any use or disclosure, in whole or in part, of the NX-OS/Titanium
Software or Documentation to any third party for any purposes is
expressly prohibited except as otherwise authorized by Cisco in writing.
The copyrights to certain works contained herein are owned by other
third parties and are used and distributed under license. Some parts
of this software may be covered under the GNU Public License or the
GNU Lesser General Public License. A copy of each such license is
available at
http://www.gnu.org/licenses/gpl.html and
http://www.gnu.org/licenses/lgpl.html
N7K-2#

 

四、ACS上查看認證信息

 

 

 

 

能夠看到以下是我先後兩次輸錯和輸對密碼的狀況：

 

 

Detail信息：