Devices¶
port49 serves unmodified network devices, so what a device does when port49 answers, refuses, errors or goes dark is the device's own behavior, and the lab is where it was measured. One page per platform says what the lab measured, what bites, and what nobody measured. The reference configurations here are the starting point for every one of them.
| Platform | Page |
|---|---|
| Arista EOS | Arista EOS |
| Cisco IOS XE (and IOL-XE) | Cisco IOS XE |
| Cisco IOS XR | Cisco IOS XR |
| Cisco NX-OS | Cisco NX-OS |
| Juniper Junos | Juniper Junos |
| Nokia SR Linux | Nokia SR Linux |
| Anything else | Other platforms |
How to read a device page¶
Every device page has the same sections, in this order:
- The lead is the one thing that bites on that platform, with the lab note that measured it linked.
- Reference configuration links the files under
deploy/device-aaa/for the platform and quotes the lines that matter. Replace the placeholders (the table below) and load the file. - What the lab measured lists what a lab run observed, each item linked to the results note that records it, with the image and the date in the note.
- Traps are the things an operator gets wrong, each linked the same way.
- Unmeasured holds everything that is not measured, one yellow box per item. A claim is measured when a linked note shows it, and unmeasured when it appears only in a yellow "Unmeasured" box. Where a box says a device is "reported" to do something, a person saw it and the lab did not measure it: treat it as an expectation, not a limit.
- Lab evidence is the table of every results note for the platform, with its image and date, generated from the notes. Each row names the lab register entry the note belongs to and its status: (closed) means the register row is measured and closed, and (open) means that row is still open, so the note is evidence for part of it and a claim that rests on the row alone is unmeasured.
A result written for one image is not a result for a release or a hardware family the page does not name. A platform that is not here was not tested.
Qualified platforms¶
This page is generated by make qualified-platforms from the committed device profiles, their goldens and the lab results notes they cite. It lists what the lab measured, not what port49 claims: a platform that is not here was not tested, and a row says only what its golden shows port49 answering.
| vendor | OS | version tested | TACACS+ 49 | TLS 300 | command authorization | command authorization over TLS | accounting | mock | status |
|---|---|---|---|---|---|---|---|---|---|
| Arista | EOS | cEOS-lab 4.36.3M | yes | yes | yes | yes | yes | yes | qualified |
| Arista | EOS | vEOS-lab 4.31.2F (image tagged 4.32.2F) | yes | — | yes | — | yes | yes | qualified |
| Cisco | IOS XE | Catalyst 8000V 17.13.01a | yes | — | yes | — | yes | yes | qualified |
| Cisco | IOS XE | Catalyst 8000V 17.18.02 | yes | yes | yes | yes | yes | yes | qualified |
| Cisco | IOS XR (XRd) | XRd control plane 26.1.1 | yes | yes | yes | yes | yes | yes | qualified |
| Cisco | NX-OS | Nexus 9300v 10.4(2)F | yes | — | yes | — | yes | yes | qualified |
| Cisco | NX-OS | Nexus 9300v 10.6(2)F | yes | yes | yes | yes | yes | yes | qualified |
| Juniper | Junos | vJunos-router 23.4R2-S2.1 | yes | — | — (L18, open) | — | yes | yes | qualified |
| Juniper | Junos | vJunos-router 26.2R1.7 | yes | yes | — (QUAL; as L18, open) | — (QUAL; as L18, open) | yes | yes | qualified |
| Juniper | Junos | vSRX3 21.4R3.15 | yes | — | — (L18, open) | — | yes | yes | qualified |
| Nokia | SR Linux | SR Linux 26.7.2-519 | yes | — | — (L76 cell b) | — | yes | yes | qualified |
What an operator must do¶
- Cisco Catalyst 8000V 17.13.01a: When port49 answers ERROR (its store is unavailable) this device does not fall to its local method: the token login is refused and break-glass fails too (QUAL store_unavailable: break-glass logged in false). Keep a path that does not depend on port49 answering (console, or a second reachable server) for the time the store is down
- Cisco Catalyst 8000V 17.18.02: When port49 answers ERROR (its store is unavailable) this device does not fall to its local method: the token login is refused and break-glass fails too (QUAL store_unavailable: break-glass logged in false). Keep a path that does not depend on port49 answering (console, or a second reachable server) for the time the store is down
- Cisco XRd control plane 26.1.1: On generic XR (platform_set 1.3.0 has no cisco_iosxr adapter, so port49 renders no attribute) every command is refused locally with "% This command is not authorized" and the device asks port49 about none: it fails safe, but nothing works (QUAL note, "without a priv-lvl block"). Add to the policy file: platforms: {cisco_iosxr: {privilege: {readonly: ["priv-lvl=1"], operator: ["priv-lvl=1"], admin: ["priv-lvl=15"]}}}. Configure command authorization on the device too (aaa authorization commands default group
local, as tests/lab/configs/xrd-startup.cfg has): without it port49 never sees a command, no role rule applies, and priv-lvl is the only bound. Only priv-lvl=15 was measured (it alone made XR send command authorization); level 1 was not. The claim that level 1 grants no more than the role is reasoning, not measurement, and holds only with command authorization configured - Cisco XRd control plane 26.1.1: When port49 answers ERROR (its store is unavailable) XRd does not fall to its local method: the token login is refused and break-glass fails too (QUAL store_unavailable: break-glass logged in false). Keep a path that does not depend on port49 answering (console, or a second reachable server) for the time the store is down
- Cisco Nexus 9300v 10.6(2)F: Over per-request TLS the device honored the single-connect port49 offers it (decision 50 ruling 20): it sent a later session on the connection after a completed one (QUAL tls_token_login)
- Nokia SR Linux 26.7.2-519: SR Linux needs a policy block or every login is refused, because platform_set 1.3.0 has no nokia_srlinux adapter and the generic adapter sends no priv-lvl (QUAL note, "without a priv-lvl block"). Add to the policy file: platforms: {nokia_srlinux: {privilege: {readonly: ["priv-lvl=1"], operator: ["priv-lvl=1"], admin: ["priv-lvl=15"]}}}. Set priv-lvl-authorization true on the device: its default false means port49 is never asked (L76 cell i); SR Linux's YANG says the session then gets full admin (srl_nokia-aaa.yang:254). Port49 command permit and deny rules never apply; the session role is the only bound (L76 cell b). So operator is read-only on SR Linux until a level between 1 and 15 is measured: at 15 an operator would be device admin with nothing to narrow it
What the status column means¶
- qualified: every cell that applies to the row read yes in the lab's golden run. A dash is a cell that does not apply, such as TLS on a device with no RFC 9887 client, and a dash that names a register entry says why (for example, the device sends no per-command authorization). A register entry written "open" is not yet measured on every platform: the dash records what the golden run saw, and the matching device page says what is unknown.
- partial: at least one cell that applies read no, or the device's per-request TLS login does not carry command authorization (a bypass never reads as a pass). The command authorization over TLS column says which.
- re-vet pending: the row's golden is marked as waiting for a new lab run, so the cells are not current. Read the device page for the last measurement.
A row says only what its golden shows port49 answering. Everything else is on the device's page.
Reference configurations¶
One file per platform and transport. Replace each placeholder, create the break-glass account by hand (with a password only you know: no file here holds one), and paste.
| Platform | TCP (RFC 8907) | TLS (RFC 9887) |
|---|---|---|
| Arista EOS | arista_eos.cfg |
arista_eos-tls.cfg |
| Cisco IOS XE | cisco_iosxe.cfg |
cisco_iosxe-tls.cfg |
| Cisco NX-OS | cisco_nxos.cfg |
cisco_nxos-tls.cfg |
| Juniper Junos | juniper_junos.set |
juniper_junos-tls.set |
| Cisco IOS XR | cisco_iosxr.cfg |
cisco_iosxr-tls.cfg |
| Nokia SR Linux | nokia_srlinux.cli |
none |
policy-platforms.yaml is the platforms: block XR and SR Linux need in the policy file.
Placeholders¶
| Placeholder | What it is |
|---|---|
<PORT49_1>, <PORT49_2> |
The two port49 servers' addresses. Always two, and distinct. |
<KEY> |
The device's shared key (TCP only; an RFC 9887 server carries none). |
<SOURCE_INTERFACE> |
EOS, IOS XE, NX-OS and XR: the interface TACACS+ is sourced from. |
<SOURCE_ADDRESS> |
Junos and SR Linux: the source address. |
<MGMT_VRF> |
The management VRF or routing instance (management, mgmt_junos, Mgmt-intf...). |
<BREAKGLASS_USER> |
The local account that works when port49 does not. |
<TLS_PORT> |
port49d's RFC 9887 listener port. Always set it: the defaults differ (below). |
<SERVER_NAME> |
This device's own name (hostname or FQDN), which its certificate carries. Not port49's hostname. |
<CERT_ID> |
The device certificate's trustpoint or certificate id. |
Pin the source (spec section 10): port49 keys a device by its source address, so it must not change with the route.
The files are in deploy/device-aaa/ in the repository.