Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation

Solutions

Featured solutions AI Campus and branch Data center WAN Security Service provider Cloud operator Industries
Campus and Branch

Welcome to the NOW Way to Wi-Fi

Take your networking performance to new heights with a modern, cloud-native, AI-Native architecture. Only Juniper can help you unleash the full potential of Wi-Fi 7 with our AI-Native platform for innovation.
Prepare for liftoff
Business intelligence analyst dashboard on virtual screen. Big data Graphs Charts.

AI Data Center Networking

Juniper’s AI data center solution is a quick way to deploy high performing AI training and inference networks that are the most flexible to design and easiest to manage with limited IT resources.
Find out more
Enterprise AI-Native Networking

Enterprise AI‑Native Routing

Juniper's Ai-Native routing solution delivers robust 400GbE and 800GbE capabilities for unmatched performance, reliability, and sustainability at scale.
Explore enterprise routing
Zero trust security

Ops4AI Lab

Visit our lab in Sunnyvale, CA and see our AI data center solution for yourself. You can try out your own model’s functionality and performance, too.
Visit the lab
Enterprise AI-Native Networking

Enterprise AI‑Native Routing

Juniper's Ai-Native routing solution delivers robust 400GbE and 800GbE capabilities for unmatched performance, reliability, and sustainability at scale.
Explore enterprise routing
Higher Education

Shaping Student Experiences: The NOW Way to Build Higher Education Networks

Juniper Networks CIO Sharon Mandell and a virtual summit of C-level IT leaders from prestigious institutions discuss ongoing efforts to support digital transformation on campus.
Watch now
Hand on tablet with healthcare overlay of graphics

Security in healthcare

In this IDC Spotlight report, discover how AI networking can automate and strengthen a healthcare ecosystem to defeat criminals and prevent loss. 
Gain insights into ecosystem security
Retail

The Future of In-Store Technologies

Retail experts Kevin McCartan, Senior IT Service Delivery Engineer at Musgrave; Jack Stratten of Insider Trends; and Christian Gilby, Senior Director of Product Marketing at Juniper Networks, discuss customer experiences.
See the future

Products

Wireless access Wired access SD-WAN / SASE Routing and switching Security Mist AI™ Management software Network operating system Blueprint for AI-Native Acceleration Optics
  • Operations
ACX7020 router

Juniper ACX7020 Cloud Metro Access Router

Legacy networks simply cannot meet the demands of today’s rapidly evolving metro landscape. Unlock a new generation of highly scalable architectures and automated operations with the Juniper ACX7020. 
Learn more
EX4000 Ethernet Switch

Next-gen AI-Native EX4000 line of switches

Lack of AI innovation from your current networking vendor slowing you down? Embrace Juniper’s cloud-native, AI-Native access switches that support every level and layer, across nearly every deployment.
Discover how
The Q and AI text with an image of Bob Friday and Kedar Dhuru.

The Q&AI Podcast

Delivering practical solutions and enriching discussions, this podcast series is a vital resource for those seeking an in-depth exploration of AI's transformative potential.
Catch the latest episode

Services

Services
Services AI Care

Juniper AI Care Services Revolutionize Your Service Experience

Our industry-first AI-Native services couple AIOps with our deep expertise across the full network life cycle. You can move from reactive response to proactive insight and action.
Explore AI Care Services
Services AI Data Center

Juniper AI Data Center Deployment Services Optimize Your AI Model Runs

We use our expertise and validated designs to help design, deploy, validate and tune networks, including GPUs and storage, to get the most from your AI infrastructure operation.
Learn about AI Data Center Deployment Services

Partners

Partners

Support and Documentation

Support and Documentation

Learn

About Juniper Training Events The Feed Resources Technology learning topics Thought leadership and insights
Audience raising hands up while businessman is speaking in training at the office.

Juniper certification and training news

See the latest
Ringing of the bell

All global events

See the latest
AI-native-now

AI-Native NOW event series

Register now
Juniper's Christina Hendrix at the head of a conference table. With the text "The NOW Way to Network" overlayed, with "NOW" emphasizing the "O" in green color.

The NOW Way to Network

Watch the video series
AI Native Now

Executive insights

Dive deep with leading experts and thought leaders on all the topics that matter most to your business, from AI to network security to driving rapid, relevant transformation for your business.
Learn more
A keynote speaker giving a presentation at a conference. There are dozens of people sitting around them. The presentation is displayed via projector on all the walls in the room.

Leadership voices

Juniper Networks’ leaders operate on the front lines of creating the network of the future. Take a look around to see what’s on their minds.
Watch now
Bob Friday and Jessica Garrison speaking

Bob Friday Talks

Join Bob as he ventures into all the knowns -- and -- unknowns -- of AI.
Catch the latest episode
Documentation
Menu
License Guide
Quick Starts
Validated Designs
Home Documentation CTP Series CTPView Network Management System Administration Managing and Displaying Users (CTPView Server Menu)

CTPView Network Management System

keyboard_arrow_up
close
keyboard_arrow_left
CTPView Network Management System
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
ON THIS PAGE
keyboard_arrow_right

Configuring CTPOS and CTPView User Authentication with TACACS+

date_range 26-May-23
arrow_backward
arrow_forward

The TACACS+ protocol provides access control (authentication, authorization, and accounting services) for routers and network access servers through one or more centralized TACACS+ servers. Unlike RADIUS, TACACS+ provides separate handling of authentication, authorization, and accounting services. CTPOS and CTPView use only authentication and authorization services, and do not use the accounting service.

CTP devices act as TACACS+ clients, which send request for authentication and authorization from the centralized TACACS+ servers that have separate user databases for CTPOS CLI users, CTPView CLI users, and CTPView Web UI users.

TACACS+ is supported only on CTPOS Release 6.4 and later and CTPView Release 4.4 and later. In earlier releases, RADIUS is used for remote authentication and authorization. Effective from CTPOS Release 6.4 and CTPView Release 4.4, both RADIUS and TACACS+ are supported.

CTP uses TACACS+ authentication to authenticate users based on the login credentials that are configured on the centralized TACACS+ servers and provides the privileges to the TACACS+ clients. The user is logged in to the device with the privileges that TACACS+ server returns after successful authentication and authorization.

Configuring TACACS+ Settings from the CTPView Server

You can configure TACACS+ for CTPView CLI and CTPView HTTPS users only from CTPView menu. You cannot enable both RADIUS and TACACS+ at the same time. You can enable TACACS+ only after disabling RADIUS.

To configure TACACS+ settings on the CTPView server:

  1. From the AAA Menu, select 2) SSH(2nd) - RADIUS/RSA > 2) TACACS+.

    The current status of TACACS+ is displayed.

    content_copy zoom_out_map
    Currently, SSH – TACACS+ is set to Disabled.

Please choose a menu item from the following list:
0) Return to previous menu
1) Enable
2) Disable
Enter your selection for SSH – TACACS+
Please input an integer between 0 and 2 [0]:
  2. Select 1) Enable to enable TACACS+.
    content_copy zoom_out_map
    Please choose a menu item from the following list:
0) Return to previous menu
1) RADIUS/RSA: Disabled
2) TACACS+: Enabled
Please input your choice [0]:
  3. Return to the AAA Menu, and select 9) TACACS+ Configuration > 1) Servers to configure the TACACS+ servers.
  4. Follow the onscreen instructions and configure the parameters as described in Table 1.
    Table 1: TACACS+ Settings for CTPView Server

    Field

    Function

    Your Action

    Servers

    You can configure up to 10 TACACS+ servers each for CTPOS and CTPView users for authentication and authorization.

    The CTP device tries to authenticate the user from the first server in the list. If the first server is unavailable or fails to authenticate, then it tries to authenticate from the second server in the list, and so on.

    Authorization is done on the server that successfully authenticates the user.

    Enter the IP address of the server and specify the shared secret.

    Shared secret is the secret key used to encrypt and decrypt packets that are sent and received from the server. The same secret key is used to encrypt and decrypt packets that are sent to and received from the TACACS+ clients.

    Destination Port

    TACACS+ uses the TCP port for sending and receiving data.

    Port 49 is reserved for TACACS+ and is the default port.

    Enter the destination port number.

    Timeout

    Time in seconds that the TACACS+ client should wait for a response from the TACACS+ server after sending the authentication and authorization request. Timeout value applies to all the TACACS+ servers that are configured.

    The default timeout value is 5 seconds.

    Specify a value in the range 1–60.

    Off-Line-Failover

    You can use the local authentication credentials if the configured TACACS+ servers are unavailable or no response is received from the TACACS+ servers.

    The default option is Allowed to Loc Acct.

    Select one.

    • Not Allowed

    • Allowed to Loc Acct

    Reject-Failover

    You can use the local authentication credentials if the TACACS+ server rejects the attempt to authenticate.

    The default option is Allowed to Loc Acct.

    Select one.

    • Not Allowed

    • Allowed to Loc Acct

  5. From the TACACS+ Menu, select 6) Initialize Web UI Template Accounts.
  6. Enter the PostgreSQL administrator account password when prompted.

    The required template accounts are added to CTPView. These accounts are not configurable. This step is performed as part of the initial configuration of CTPView as a TACACS+ client. However, repeating this step has no detrimental effect on the TACACS+ configuration.

Configuring TACACS+ Settings from the CTPView Web Interface

You can configure TACACS+ for CTPOS users from the CTPView web interface.

To configure TACACS+ from the CTPView web interface:

  1. In the side pane, select System > Configuration.
  2. Click Node Settings > TACACS+ Settings tab.

    The TACACS+ Settings page is displayed.

  3. Configure the parameters described in Table 2 and click Submit Settings.
  4. (Optional) Click System > Query > Node Settings to verify the TACACS+ configuration details.
    Table 2: TACACS+ Settings for the CTPView Web Interface

    Field

    Function

    Your Action

    Status

    Specifies whether TACACS+ is enabled or disabled.

    TACACS+ is disabled by default.

    Select one.

    • Enabled

    • Disabled

    Dest Port

    TACACS+ uses the TCP port for sending and receiving data.

    Port 49 is reserved for TACACS+ and is the default port.

    Enter the destination port number.

    Timeout

    Time in seconds that the TACACS+ client should wait for a response from the TACACS+ server after sending the authentication and authorization request. Timeout value applies to all the TACACS+ servers that are configured.

    The default timeout value is 5 seconds.

    Specify a value.

    Off-Line-Failover

    You can use the local authentication credentials if the configured TACACS+ servers are unavailable or no response is received from the TACACS+ servers.

    The default option is Allowed to Loc Acct.

    Select one.

    • Not Allowed

    • Allowed to Loc Acct

    Reject-Failover

    You can use the local authentication credentials if the TACACS+ server rejects the attempt to authenticate.

    The default option is Allowed to Loc Acct.

    Select one.

    • Not Allowed

    • Allowed to Loc Acct

    Servers

    You can configure up to 10 TACACS+ servers each for CTPOS and CTPView users for authentication and authorization.

    CTP tries to authenticate the user from the first server in the list. If the first server is unavailable or fails to authenticate, then it tries to authenticate from the second server in the list, and so on.

    Authorization is done on the server that successfully authenticates the user.

    Enter the IP address of the server, and specify a shared secret.

    Shared Secret

    Shared secret is the secret key that TACACS+ servers use to encrypt and decrypt packets that are sent and received from the server. TACACS+ clients use the same secret key to encrypt and decrypt packets.

    Specify the shared secret.

Related Documentation

arrow_backward PREVIOUS Configuring CTPView User Authentication with Steel-Belted RADIUS
NEXT arrow_forward Configuring the TACACS+ Server
footer-navigation

© 1999 - 2025 Juniper Networks, Inc. All rights reserved.

Scroll to top