Arista EOS¶
EOS sends its leaf certificate alone over RFC 9887, so set intermediates_file under tls_listener in port49d.yaml to give port49 the intermediate it needs to verify that leaf. EOS also dials 300, the RFC's port, when none is set, and refuses a server certificate that does not name the address it was configured with (L73-arista_ceos.md, cells a, d and e). Measured on vEOS-lab 4.31.2F (TCP) and cEOS-lab 4.36.3M (TCP and RFC 9887).
Reference configuration¶
Load arista_eos.cfg (TACACS+ on port 49) or arista_eos-tls.cfg (RFC 9887, EOS 4.36.1F or later). The placeholders table says what each placeholder is. Create the break-glass account by hand. The lines that matter, quoted from the files:
ip tacacs vrf <MGMT_VRF> source-interface <SOURCE_INTERFACE>
tacacs-server host <PORT49_1> vrf <MGMT_VRF> key 0 <KEY>
aaa group server tacacs+ port49
server <PORT49_1> vrf <MGMT_VRF>
server <PORT49_2> vrf <MGMT_VRF>
aaa authentication login default group port49 local
aaa authorization exec default group port49 local
aaa authorization commands all default group port49 local
Over TLS the host lines carry the profile and the port:
tacacs-server tls ssl-profile port49-tacacs
tacacs-server host <PORT49_1> tls vrf <MGMT_VRF> single-connection port <TLS_PORT>
What the lab measured¶
- A deny port49 answers is never tried locally (L4-arista_eos.md).
- An ERROR does not make break-glass a way around port49: the login falls to the local account, then the exec authorization goes to port49, gets FAIL
store_unavailable, and does not go on to local, so the person is thrown out (L4-error-arista_eos.md). Troubleshooting says what to do. - With port49d stopped, break-glass logs in in 60 ms on vEOS and 2.4 s on cEOS; with port49d dark, in 150 ms and 2.5 s (L88-arista_eos.md; L88-arista_ceos.md, cells b and d).
- While port49 is dark, commands in sessions that were already open ran under local authorization, so a command port49 would deny is then decided locally (L41-arista_eos.md, cell 3).
- With the first server resetting at accept, a token login reached the second in 300 ms on vEOS and 2.1 s on cEOS (L88-arista_eos.md; L88-arista_ceos.md, cell f).
- Over RFC 9887 on cEOS 4.36.3M: break-glass in 2.3 s with port49d stopped and 2.4 s dark, and a token login through the second server in 2.9 s (L88-arista_ceos-tls.md).
- Over RFC 9887 EOS sends no server name and offers a session ticket, which port49 accepted 11 of 11 times (L73-arista_ceos.md, cells c and g).
- Break-glass with single-connection on, after port49d reset a de-admitted device's connection, was closed with the fix: on every declined path it logged in within 0.5 s of the key miss (L31-arista_eos.md).
Traps¶
- Set
intermediates_filefor EOS: it sends its leaf alone, and without the intermediate the chain does not verify (L73-arista_ceos.md, cell e). - Set the TLS port explicitly. With none set EOS dials 300, so the
portyou set must match port49d's RFC 9887 listener (L73-arista_ceos.md, cell a). - Configure the host by the address its certificate names: EOS refuses a server certificate that does not name the configured address, with a
bad_certificatealert (L73-arista_ceos.md, cell d). - Keep a path that does not need port49 for an ERROR: the local account is thrown out by the exec authorization (L4-error-arista_eos.md).
Unmeasured¶
Unmeasured: the source-interface clause
The EOS reference adds ip tacacs vrf <MGMT_VRF> source-interface <SOURCE_INTERFACE>; the lab's own startup config pinned none. The reference README reports that the clause loaded as shipped, in the default VRF, on vEOS and cEOS, which this page cannot confirm against a note line. Check that port49 sees the source address you pinned.
Unmeasured: other EOS releases and hardware
The lab ran vEOS-lab 4.31.2F over TCP and cEOS-lab 4.36.3M over TCP and RFC 9887. What other releases and hardware do is unknown.
Lab evidence¶
| Entry | Platform | Image | Date | Note |
|---|---|---|---|---|
| L1 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-20 | L1-arista_eos.md |
| L2 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-10-01 | L2-arista_eos.md |
| L3 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-05 | L3-arista_eos.md |
| L4 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-20 | L4-arista_eos.md |
| L4 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-24 | L4-error-arista_eos.md |
| L5 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-20 | L5-arista_eos.md |
| L6 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-20 | L6-arista_eos.md |
| L7 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L7-arista_eos.md |
| L7 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-23 | L7-login-arista_eos.md |
| L8 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-05 | L8-arista_eos.md |
| L10 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-05 | L10-arista_eos.md |
| L13 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-20 | L13-arista_eos.md |
| L15 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-21 | L15-clients-arista_eos.md |
| L16 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-21 | L16-arista_eos.md |
| L18 (open) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-22 | L18-arista_eos.md |
| L21 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F; show version: Software image version: 4.31.2F) |
2026-09-24 | L21-arista_eos.md |
| L22 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-05 | L22-arista_eos.md |
| L22 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L22-carried-arista_eos.md |
| L23 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L23-arista_eos.md |
| L28 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-07 | L28-arista_eos.md |
| L28 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-30 | L28-held-arista_eos.md |
| L29 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-30 | L29-reload-arista_eos.md |
| L31 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-09-30 | L31-arista_eos.md |
| L33 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-10-01 | L33-e2e-nautobot-arista_eos.md |
| L33 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-10-01 | L33-e2e-netbox-arista_eos.md |
| L34 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L34-arista_eos.md |
| L35 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L35-arista_eos.md |
| L35 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L35-restore-arista_eos.md |
| L37 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L37-arista_eos.md |
| L39 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-10-05 | L39-docker-proxy-off-arista_eos.md |
| L39 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-10-05 | L39-docker-proxy-on-arista_eos.md |
| L41 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L41-arista_eos.md |
| L49 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L49-oxidized-arista_eos.md |
| L51 (closed) | arista_eos | vEOS-lab, show version: Software image version: 4.31.2F (container tag vrnetlab/arista_veos:4.32.2F; the image running is 4.31.2F) |
2026-10-09 | L51-arista_eos.md |
| L53 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L53-arista_eos.md |
| L54 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-10-09 | L54-arista_eos.md |
| L56 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L56-arista_eos.md |
| L64 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-07 | L64-arista_eos.md |
| L65 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-07 | L65-arista_eos.md |
| L66 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-07 | L66-arista_eos.md |
| L71 (closed) | arista_ceos | cEOS-lab 4.36.3M | 2026-10-18 | L71-arista_ceos.md |
| L71 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-05 | L71-arista_eos.md |
| L73 (closed) | arista_ceos | cEOS-lab 4.36.3M | 2026-11-05 | L73-arista_ceos.md |
| L88 (closed) | arista_ceos | cEOS-lab 4.36.3M | 2026-11-04 | L88-arista_ceos-tls.md |
| L88 (closed) | arista_ceos | cEOS-lab 4.36.3M | 2026-11-04 | L88-arista_ceos.md |
| L88 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-04 | L88-arista_eos.md |
| L90 (closed) | arista_eos | vEOS-lab 4.31.2F (image tagged 4.32.2F) | 2026-11-06 | L90-oxidized-arista_eos.md |