TACACS+ Configurator

NAME                                    READY   STATUS    RESTARTS   AGE

nac-appliance-tacacs-ng-<hash>          1/1     Running   0          1m

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication enable default group tacacs+

aaa authorization exec default group tacacs+ local

aaa authorization commands 1 default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

tacacs server NAC-TACACS

    address ipv4 <customer-vm-ip>

    key <shared-secret>

! TACACS+ server

tacacs-server host <TACACS_SERVER_IP> key 7 <SHARED_SECRET>

tacacs-server timeout 10

! AAA server group

aaa group server tacacs+ NAC-TACACS

    server <TACACS_SERVER_IP>

! Authentication

aaa authentication login default group NAC-TACACS local

aaa authentication enable default group NAC-TACACS local

! Authorization

aaa authorization exec default group NAC-TACACS local

aaa authorization commands all default group NAC-TACACS local

! Accounting

aaa accounting exec default start-stop group NAC-TACACS

aaa accounting commands all default start-stop group NAC-TACACS

aaa accounting system default start-stop group NAC-TACACS

# TACACS+ server

set system tacplus-server <TACACS_SERVER_IP> secret "<SHARED_SECRET>"

set system tacplus-server <TACACS_SERVER_IP> timeout 10

set system tacplus-server <TACACS_SERVER_IP> single-connection

# Authentication order: TACACS+ first, fall back to local

set system authentication-order [ tacplus password ]

# Login classes for role mapping

set system login class TACACS-ADMIN permissions all

set system login class TACACS-ADMIN allow-commands ".*"

set system login class TACACS-ADMIN deny-commands ""

set system login class TACACS-OPERATOR permissions [ view view-configuration ]

set system login class TACACS-OPERATOR allow-commands "(show|ping|traceroute|help|exit|quit)"

set system login class TACACS-OPERATOR deny-commands "(request|set|delete|run|clear)"

# Wildcard remote user — required for TACACS+ logins

set system login user remote full-name "TACACS Remote User"

set system login user remote class TACACS-OPERATOR

set shared server-profile tacacs TACACS-NAC server <TACACS_SERVER_IP> port 49

set shared server-profile tacacs TACACS-NAC server <TACACS_SERVER_IP> secret <SHARED_SECRET>

set shared server-profile tacacs TACACS-NAC use-single-connection yes

set shared server-profile tacacs TACACS-NAC timeout 10

set shared authentication-profile TACACS-AUTH protocol TACACS+

set shared authentication-profile TACACS-AUTH server-profile TACACS-NAC

set shared authentication-profile TACACS-AUTH allow-list all

set deviceconfig system authentication-profile TACACS-AUTH

# TACACS+ server definition

config user tacacs+

    edit "TACACS-NAC"

        set server <TACACS_SERVER_IP>

        set key <SHARED_SECRET>

        set authen-type pap

        set port 49

    next

end

# Admin access profiles

config system accprofile

    edit "TACACS-FULL-ACCESS"

        set secfabgrp read-write

        set ftviewgrp read-write

        set authgrp read-write

        set sysgrp read-write

        set netgrp read-write

        set loggrp read-write

        set routegrp read-write

        set fwgrp read-write

        set vpngrp read-write

        set utmgrp read-write

    next

    edit "TACACS-READ-ONLY"

        set secfabgrp read

        set ftviewgrp read

        set authgrp read

        set sysgrp read

        set netgrp read

        set loggrp read

        set routegrp read

        set fwgrp read

        set vpngrp read

        set utmgrp read

    next

end

# User group linked to TACACS+ server

config user group

    edit "TACACS-ADMINS"

        set member "TACACS-NAC"

    next

end

# Wildcard admin using TACACS+ auth

config system admin

    edit "tacacs_admin"

        set remote-auth enable

        set accprofile "TACACS-FULL-ACCESS"

        set wildcard enable

        set remote-group "TACACS-ADMINS"

    next

end

# Configure TACACS+

tmsh modify auth tacacs system-auth {

    secret <SHARED_SECRET>

    servers add { <TACACS_SERVER_IP> }

    service ppp

    protocol ip

}

# Set auth source

tmsh modify auth source { type tacacs }

# Remote role mapping via VSA

tmsh modify auth remote-role {

    role-info add {

        TACACS-ADMIN {

            attribute "F5-LTM-User-Info-1=admin"

            console tmsh

            line-order 10

            role administrator

            user-partition All

        }

        TACACS-OPERATOR {

            attribute "F5-LTM-User-Info-1=operator"

            console tmsh

            line-order 20

            role operator

            user-partition Common

        }

    }

}

# Default fallback for unmatched remote users

tmsh modify auth remote-user {

    default-role operator

    default-partition Common

}

tmsh save sys config