TACACS (AAA) Configuration in Juniper and Cisco(IOS-XR,IOS-XE,IOS,NX-OS)

Configuring Juniper and Cisco to authenticate (also including authorization and accounting) to Tacacs+ server

10.10.10.10 - Tacacs+ AAA server
20.20.20.2 -  Loopback IP

Juniper:

system {
    host-name JUNIPER-ROUTER1;
       }
    authentication-order [ tacplus password ];
    root-authentication {
        encrypted-password "$r00tp44sw0rdh3r3/1"; ## SECRET-DATA
    }
    tacplus-server {
        10.10.10.10 {
            secret "$4ut0g3n3r4t3t4c4c5p455w0rd1"; ## SECRET-DATA
            single-connection;
            source-address 20.20.20.2;
        }
       }
    accounting {
        events interactive-commands;
        destination {
            tacplus {
                server {
                    10.10.10.10 {
                        secret "$4ut0g3n3r4t3t4c4c5p455w0rd2"; ## SECRET-DATA
                        single-connection;
                        source-address 20.20.20.2;
                    }
           }

firewall {
    family inet {
 filter FIREWALL-RE {
            /* TRUSTED TACACS */
            term TACACS-ACL {
                from {
                    source-address {
                        10.10.10.10/32;
                     
                    }
                    protocol tcp;
                    port tacacs;
                }
                then {
                    count TACACS-ACL;
                    accept;
                }
            }     

In set format:

set system host-name JUNIPER-ROUTER1
set system authentication-order tacplus
set system authentication-order password
set system root-authentication encrypted-password "$r00tp44sw0rdh3r3/1"
set system tacplus-server 10.10.10.10 secret "$4ut0g3n3r4t3t4c4c5p455w0rd1"
set system tacplus-server 10.10.10.10 single-connection
set system tacplus-server 10.10.10.10 source-address 20.20.20.2
set system accounting destination tacplus server 10.10.10.10 secret "$4ut0g3n3r4t3t4c4c5p455w0rd2"
set system accounting destination tacplus server 10.10.10.10 single-connection
set system accounting destination tacplus server 10.10.10.10 source-address 20.20.20.2


set firewall family inet filter FIREWALL-RE term TACACS-ACL from source-address 10.10.10.10/32
set firewall family inet filter FIREWALL-RE term TACACS-ACL from source-address 20.20.20.2/32
set firewall family inet filter FIREWALL-RE term TACACS-ACL from protocol tcp
set firewall family inet filter FIREWALL-RE term TACACS-ACL from port tacacs
set firewall family inet filter FIREWALL-RE term TACACS-ACL then count TACACS-ACL
set firewall family inet filter FIREWALL-RE term TACACS-ACL then accept

Cisco:

IOS:

aaa authentication login VTY group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

tacacs-server host 10.10.10.10 single-connection
tacacs-server key 7 1234567890
ip tacacs source-interface Loopback0


IOS-XE:
aaa authentication login VTY group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

tacacs server TACACS-SERVER
 address ipv4 10.10.10.10
 key 7 1234567890

ip tacacs source-interface Loopback0


NEXUS OS
aaa authentication login default group tacacs
aaa authentication login console group tacacs
aaa authorization config-commands default group tacacs local
aaa authorization commands default group tacacs local
aaa accounting default group tacacs

tacacs+ distribute
ip tacacs source-interface mgmt0
tacacs-server host 10.10.10.10 key 7 "tacacs_pass"
aaa group server tacacs+ tacacs
    server 10.10.10.10


IOS-XR
aaa accounting exec VTY start-stop group tacacs+
aaa accounting commands VTY start-stop group tacacs+
aaa authorization exec VTY group tacacs+ none
aaa authorization commands VTY group tacacs+ none
aaa authentication login VTY group tacacs+ line local

tacacs source-interface Loopback0 vrf default
tacacs-server host 10.10.10.10 port 49
 key 7 1234567890123456789