Forum Discussion

dan_03_140075's avatar
dan_03_140075
Icon for Nimbostratus rankNimbostratus
Mar 27, 2014

How can I verify Remote Role Groups via TACACS+ auth

Hello. My F5 v11.4 and 11.3 devices have tacacs authentication to AD for admin access to gui and terminal. We do however create F5 local users for this to work. So use my MS AD user name and password...
application delivery
BIG-IP Access Policy Manager (APM)
LTM
management
security
  • Cory_50405's avatar
    Cory_50405
    Apr 04, 2014

    So here are the specifics of the configuration we are using:

    Cisco ACS 5.3 as our TACACS server Under Policy Elements -> Authorization and Permissions -> Device Administration -> Shell Profiles, we defined multiple profiles depending on the level of authorization for the remote users. I'll detail our administrator role, but the other roles can be built accordingly.

    Under the Custom Attributes tab of the shell profile for the administrator role, our attribute is 'F5-LTM-User-Info-1', with a value of 'adm'. You then apply this shell profile to the ACS group that you want to be able to have administrator access to the BIG-IP.

    Our corresponding remote role config in the BIG-IP looks like this:

    /Common/F5_Administrator {
 attribute F5-LTM-User-Info-1=adm
  console tmsh
  line-order 1
  role administrator
  user-partition all
}

    All of the AD specific user and group information should stay between the TACACS server and AD.

Cory_50405's avatar
Cory_50405
Icon for Noctilucent rankNoctilucent

Can you point the BIG-IP to your TACACS server instead and use that kind of authentication/authorization? We have remote role working with TACACS without issue, so I can assist further with that setup.

 

Cory_50405's avatar
Cory_50405
Icon for Noctilucent rankNoctilucent
Mar 27, 2014
If I recall, I think we had to specify PPP as the service in order to get it to work.