topic RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch? in ExtremeSwitching (EXOS/Switch Engine)

Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Jitendra_Patel — Mon, 26 Nov 2018 16:59:00 GMT

Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?
If yes then please share sample Configuration for Summit X440-24-G2 Switch.

RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Erik_Auerswald — Mon, 26 Nov 2018 19:44:00 GMT

Hi,

the documentation says regarding enable tacacs:

After they have been enabled, all web and Telnet logins are sent to one of the two TACACS+ servers for login name authentication.

RADIUS can be enabled and disabled independently for switch management and 802.1X, thus I would say that yes, EXOS should be able to use TACACS+ for switch management access authentication and RADIUS for 802.1X at the same time.

Thanks,
Erik

RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Erik_Auerswald — Mon, 26 Nov 2018 19:44:00 GMT

Please see the below comments, it seems as if EXOS does not support TACACS+ and RADIUS at the same time, not even for different authentication realms.

RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Ty_Izzet — Mon, 26 Nov 2018 19:50:00 GMT

Per the EXOS User Guide:

"TACACS+ provides many of the same features provided by RADIUS. You cannot use RADIUS
and TACACS+ at the same time."

I have in the past had both configured on the same switch, but used them independently. This is helpful in a migration from TACACS to RADIUS. Both authentication methods were not enabled at the same time.

RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Erik_Auerswald — Mon, 26 Nov 2018 19:50:00 GMT

Thanks for the information!

But TACACS+ does not support EAP, thus it does not support 802.1X authentication, while RADIUS does. According to the User Guide, EXOS cannot use TACACS+ to authenticate network login using TACACS+.

Does enabling TACACS+ (for CLI access to the switch) really interfere with using RADIUS for 802.1X (netlogin) only? I think that is an unexpected limitation of EXOS.

Anyway, with the User Guide explicitly and repeatedly stating that TACACS+ and RADIUS cannot be used at the same time on EXOS, I stand corrected, EXOS does not seem to support this.

Thanks,
Erik

RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Ty_Izzet — Mon, 26 Nov 2018 19:50:00 GMT

Understood. It was just clarification on that only one could be used at a time. See error below if both are attempted to be enabled:

* X450a-24t.8 # en radius
Error: You have TACACS+ enabled. To enable RADIUS, disable TACACS+

* X450a-24t.9 # dis tacacs
* X450a-24t.10 # en radius
* X450a-24t.11 #

RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Erik_Auerswald — Mon, 26 Nov 2018 19:50:00 GMT

Thanks for confirming this with switch output!

RE: Can we configure TACACS+ Server for Switch Management and 802.1X User Authentication on RADIUS server on same EXOS switch?

Jitendra_Patel — Mon, 26 Nov 2018 22:33:00 GMT

Thanks for your inputs, so finally I conclude that TACACS & RADIUS can not be configured simultaneously in EXOS. So to enable 802.1x User authentication through a RADIUS, we must disable TACACS for switch Management.
Please correct me if I am wrong.