NetIM supports integration with TACACS+ servers for authentication and authorization (AAA). To enable TACACS+ integration, you must log into NetIM Core VM as netadmin and then enable TACACS+ integration using the app.sh target, by entering the following command:

After enabling TACACS+ integration, navigate to Configure,->All Settings->Integrate->TACACS+ to access the TACACS+ Configurations page, as shown in the following screen:

Before setting up TACACS+ authentication and/or authorization, ensure that you have the following required TACACS+ configuration data from your TACACS+ administrator:

You and TACACS+ administrator must decide whether you want TACACS+ to provide just user authentication or both user authentication and user authorization. If you choose just user authentication, you can set a default NetIM role for all TACACS+ users in the NetIM TACACS+ configuration page, as follows:

You can also assign a specific role to any user in the NetIM User Management page (Configure->All Settings->Administer->User Management) as shown in the following screen. For more information, see Appendix: Tracking User Logins,

If you want TACACS+ to provide authorization as well as authentication, select the check box for “Require Authorization” and provide the authorization attributes and role attributes, as shown in the following screen:

The following settings demonstrate one way of configuring authorization on the NetIM TACACS+ authorization-screen:

On the TACACS+ server, you must define the roles as shown. (The roles should be in all CAPs as shown.)

After enabling and configuring TACACS+ integration, the NetIM login screen presents an option to use TACACS, as follows:

Any errors encountered will be displayed in the login screen. If you successfully log in using TACACS+, you can click the username in the upper right side. and view your user profile, as follows:

If you have admin rights, then you can go to the NetIM User Management page (Configure->All Settings->Administer->User Management) and view the Active User Sessions, as follows:

There are numerous vendors of TACACS+ servers with many different deployment options, so your TACACS+ configuration may be unique to your enterprise and require different Authorization Attributes and Role Attribute settings. You should work with your TACACS+ administrator to design an integration that works for both ends of the integration.

TACACS+ integration may require some debugging on both ends, including Wireshark packet captures. To turn on debugging in NetIM, go to the Core Server Management page and turn the Debug State of the NetIM Web Service to On.

To view debug output, look in the Catalina.out log file in: <install_dir>/webServer/jakarta-tomcat/logs on NetIM core.

Alternatively, you can turn on debug in the <install-dir>/webServer/jakarta-tomcat/webapps/vnes/WEB-INF/classes/logback.xml file and restart the web service.

to: