TACACS+ configuration using Huawei's (VRP) OS. This is about configuring authentication and authorization using the TACACS+ protocol. Usually or the universal approach, that works among all routers, is set a value to the wide used VSA priv-lvl which is explained in Configuring TACACS+NG authentication for VRP - blog entry.

Obvious at the start, I am not much of a VRP expert myself. This blog entry is about how to configure TACACS+NG to assign VRP RBAC roles to authenticating users in a simple nutshell networking lab. So email me please, if you have something to correct in this approach.

Most big vendor's router/switch/firewall OS implementations offer RBAC based profile assignment. Huawei's VRP has RBAC in place to be used. How to configure using TACACS+NG and assign VRP RBAC roles to authenticating users.

The initial VRP basic configuration steps are explained Configuring TACACS+NG authentication for VRP. a blog entry about AUTHENTICATION only, using priv-lvl assignment. The approach that every professional router OS offers when it comes to basic AAA configuration,

The TACACS+ daemon used in this netlab is Marc Hubers's Pro-Bono-Publico: TACACS+NG.

Using both at same time, would add another level of complexity. This example is meant to be simple. The priv-lvl assignment configuration using TACACS+NG is already explained in Configuring TACACS+NG authentication for VRP netlab.

Topology

IP addressing

The IP addressing used in this netlab. 3 appliances:

TACACS+ daemon settings:

R1's connected interfaces:

R1#sh ip int brie | e un
Interface              IP-Address      OK? Method Status                Protocol
Ethernet0/0            10.100.200.50   YES NVRAM  up                    up
Ethernet0/2            10.100.100.1    YES manual up                    up
Ethernet0/3            10.100.250.1    YES manual up                    up

R1 IP connected routes, overview in CIDR notation showing the connected subnet mask to interface:

R1#sh ip route connected | i C
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
C        10.100.100.0/24 is directly connected, Ethernet0/2
C        10.100.200.48/30 is directly connected, Ethernet0/0
C        10.100.250.0/24 is directly connected, Ethernet0/3

Testing authentication is done from the node-10 to the router R108 using telnet protocol.

R1 is forwarding IP packets and has no other role, R1 is a symbol for a dynamic routed enterprise network. IP routing within a secure domain.

User settings overview related to the TACACS+ configuration:

VRP version

The HWTACACS configuration is tested on QEMU VRP NE5000E running this code:

Vendor-specific Attributes

Information about VSAs is mostly found in the RADIUS section of vendor documentation. This is from the NetEngine documentation:

The RADIUS client supports a set of Huawei-proprietary attributes. The Structure of Management Information (SMI) Network Management Private Enterprise Code for Huawei is "2011". This vendor ID is used to identify Huawei vendor-specific attributes (VSAs). After the RADIUS client receives VSAs from the RADIUS server, the RADIUS client determines the rights and services for user access. The RADIUS client supports the following vendor-specific attributes:

• FTP Directory (26–28)
• User Level (26–29)
• User Group Name (26–251)
• User Service Type (26–252)

26 denotes a VSA in the RADIUS packet and 26–x denotes Vendor type x in the VSA.

• The priv-lvl in the Huawei Vendor Specfic Attribute VSA - 26-29 (which is not used in example)
• The User Group Name is the Huawei Vendor Specific Attribute VSA - 26-251.

VRP RBAC

Overview of VRP Role Based Access Control naming scheme:

<R108>display user-group
------------------------------------------------------
User-group-name                          User-group-id
------------------------------------------------------
manage-ug                                            1
system-ug                                            2
monitor-ug                                           3
visit-ug                                             4
------------------------------------------------------
Total 4, 4 printed

The User-group-name shown above, is the VSA from the RADIUS documentation. That part will be used in TACACS+ to chose the right profile.

The user-group manage-ug has its corresponding task-group manage-tg associated:

<R108>display user-group manage-ug
-----------------------------------------------------------
User group name     : manage-ug
-----------------------------------------------------------

Task group authorization
-----------------------------------------------------------
TaskGroupName
-----------------------------------------------------------
manage-tg
-----------------------------------------------------------
Total 1, 1 printed

Every user group has a pre-defined set of allowed local commands.

Every task-group has its set of commands.

The other VRP task groups have a much bigger list of allowed commands. visit-tg output is short, it has only few authorized commands.

The output of allowed commands in the the visit-tg task-group:

<R108>display task-group visit-tg
-----------------------------------------------------------
Task group name     : visit-tg
-----------------------------------------------------------

Task authorization
-----------------------------------------------------------
TaskName                          Authorization
-----------------------------------------------------------
sla                               execute
shell                             read write execute
tpoam                             execute
tailmode1                         execute
tailmode2                         execute
trilloam                          execute
-----------------------------------------------------------
Total 6, 6 printed

It is possible to configure and operate both approaches, only not for the same user or group. This approach would add another level of complexity.

TACACS+

This netlab is using the TAC_PLUS-NG server project from Event-driven servers.

Version of TACACS+NG used:

Configuration

A stand alone configuration with demo users, and demo groups, and RBAC role assignment, setting a VSA value, using following TACACS+ syntax:

...
set user-group-name=manage-ug
...

The Vendor Specific Attribute VSA user-group-name, with a value set to manage-ug.

Display VRP's RBAC overview using the display user-group command:

<R108>display user-group
------------------------------------------------------
User-group-name                          User-group-id
------------------------------------------------------
manage-ug                                            1
system-ug                                            2
monitor-ug                                           3
visit-ug                                             4
------------------------------------------------------
Total 4, 4 printed

The RBAC output, is used the in the profile section of TACACS+NG configuration.

Ready configuration tac_plus-ng.cfg file for this netlab. AAA server configuration ready to use:

#!/usr/sbin/tac_plus-ng
id = spawnd {
    listen = { address = 0.0.0.0 port = 49 }
}

id = tac_plus-ng {

    host IPv4only {
        address = 0.0.0.0/0
        welcome banner = "\n Welcome VRP to TACACS+NG\n\n"
        key = 123-my_tacacs_key
    }

    profile vrp-lvl3 {
        script {
            if (service == shell) {
                if (cmd == "") {
                    set user-group-name=manage-ug
                    permit
                }
            }
        }
    }

    profile vrp-lvl2 {
        script {
            if (service == shell) {
                if (cmd == "") {
                    set user-group-name=system-ug
                    permit
                }
            }
        }
    }

    profile vrp-lvl1 {
        script {
            if (service == shell) {
                if (cmd == "") {
                    set user-group-name=monitor-ug
                    permit
                }
            }
        }
    }

    group NET-exp
    group NET-pro
    group NET-ent

    user demo0 {
    password { login = clear demo }
        member = NET-exp
    }
    user demo1 {
    password { login = clear demo }
        member = NET-pro
    }
    user demo2 {
    password { login = clear demo }
        member = NET-ent
    }

    ruleset {
        rule {
            script {
                if (member == NET-exp) { profile = vrp-lvl3 permit }
                if (member == NET-pro) { profile = vrp-lvl2 permit }
                if (member == NET-ent) { profile = vrp-lvl1 permit }
            }
        }
    }
}

The example above is missing last username demo3 its group and profile assignment. This is the most basic configuration on how to get the RBAC working with VRP.

VRP

IP setup

• Hostname R108
• Address 10.100.100.108/24
• Gateway 10.100.100.1

Configuration lines for the VRP router:

system-view
undo dcn
y

telnet server enable
sysname R108
interface Ethernet1/0/1
 undo shutdown
 ip address 10.100.100.108 255.255.255.0
quit
ip route-static 0.0.0.0 0.0.0.0 10.100.100.1

Verify IP connectivity to the TACACS+ server from router R108:

The TACACS+ server is reachable from the NAS.

HWTACACS auten/author example

VRP authentication and authorization configuration procedure:

• Create hwtacacs server template aaa-49
• Create aaa authentication scheme aaa-tacacs
• Create aaa authorization scheme aaa-tacacs
• Apply created AA setings to the local default domain default_admin
• • (Optional) Apply created AA settings to a new domain example.net
• • (Optional) Set the default admin domain to example.net
• Change user-interface vty authentication mode to use aaa

This results in following AAA configuration for authenticating users:

system-view
#
hwtacacs enable
#
hwtacacs-server template aaa-49
 hwtacacs-server authentication 10.100.200.49 49
 hwtacacs-server authorization 10.100.200.49 49
 hwtacacs-server shared-key cipher 123-my_tacacs_key
 hwtacacs user-name original
 quit
#
aaa
 authentication-scheme aaa-tacacs
 authentication-mode hwtacacs local
 authorization-scheme aaa-tacacs
 authorization-mode hwtacacs local
 quit
#
domain default_admin
 authentication-scheme aaa-tacacs
 authorization-scheme aaa-tacacs
 hwtacacs-server aaa-49
 quit
#
user-interface vty 0 4
 authentication-mode aaa
 quit
#
commit
#

VRP AAA configuration finished.

Verify

Now let us check if the AAA setup is working properly.

Telnet to the router, and authenticate using the previously configured credentials.

After successful authentication, the only command that works display access-user self command. Output of demo2 authenticated user, verify the User group name shown in the output below:

User demo2 has successfully authenticated and the user role assigned to this test user is the monitor-ug RBAC group. Everything works.

Troubleshooting

Common issues while configuring RBAC using Huawei's VRP. I am not a VRP professional. I am confident this helps someone configuring RBAC with TACACS/RADIUS in his own networ.

HWTACACS default username setting

In the default VRP setting, after activating HWTACACS with the hwtacacs enable command, the domainname is applied to the sent username to TACACS+ daemon.

If things do not work the AAA authentication, in the HWTACACS default setting, VRP sends the domain name applied to the username:

Use the display hwtacacs-server template command to verify the setting. The Domain included is set to Yes in that case:

<R108>display hwtacacs-server template
--------------------------------------------------------------
Template name                          : aaa-49
Template ID                            : 0
Primary authentication server          : 10.100.200.49-49:-
Primary authorization server           : 10.100.200.49-49:-
Primary accounting server              : 0.0.0.0-0:-
Primary common server                  : 0.0.0.0-0:-
Current authentication server          : 10.100.200.49-49:-
Current authorization server           : 10.100.200.49-49:-
Current accounting server              : 0.0.0.0-0:-
Source IP address                      : 0.0.0.0
Shared key                             : ****************
Quiet interval (min)                   : 5
Response timeout interval (sec)        : 5
Domain included                        : Yes
Secondary authentication server count  : 0
Secondary authorization server count   : 0
Secondary accounting server count      : 0
Secondary common server count          : 0
--------------------------------------------------------------

VRP sends the username demo0@default_admin. Matching TACACS+ debug output for above VRP default setting:

This results in no such user, and failed user authentication.

Setting the hwtacacs user-name original configuration in HWTACACS is mandatory to have username ONLY, being sent for authentication from the NAS. This is applied to the template aaa-49 definition.

system-view
#
hwtacacs enable
#
hwtacacs-server template aaa-49
 #
 # Send user-name only, WITHOUT domain suffix
 #
 hwtacacs user-name original
#
return

TACACS+NG authentication debugging mode, after applied changes above.

Authentication debug output from authenticates on the tested NAS. VRP uses the ASCII method, now correctly shown authenticating user is demo0, without the domain part, resulting in a successful user authentication and authorization:

After the correct configuration the NAS sends the desired username to the TACACS+NG daemon.

Ready

HWTACACS configuration does not stick across appliance reboots

This is a specific issue and its workaround related to the used GNS3 netlab NAS, or router, here the NE5000E appliance. Thing explained here are not needed for the TACACS+ configuration process above to work.

Issue

The annoyance is the HWTACACS configuration is empty after a reboot when using the domain aaa domain default_admin setting for VRP AAA configuration:

<R108>dis cur conf aaa
#
aaa
 #
 authentication-scheme default0
 #
 authentication-scheme default1
 #
 authentication-scheme default
 #
 authentication-scheme aaa-tacacs
  authentication-mode hwtacacs local
 #
 authorization-scheme default
 #
 authorization-scheme aaa-tacacs
  authorization-mode hwtacacs local
 #
 accounting-scheme default0
 #
 accounting-scheme default1
 #
 domain default0
 #
 domain default1
 #
 domain default_admin
  authentication-scheme aaa-tacacs
  authorization-scheme aaa-tacacs
#
return

The configuration is kaputt, hwtacacs server setting is empty. Suspecting it is overwritten to be left in default state or some other mechanism.

Workaround

Move the VRP AAA configuration away from defaults here domain default. Create a domain: domain example.org. And set default-domain admin example.org when the configuration at the end of AAA configuration.

system-view
hwtacacs enable
#
hwtacacs-server template aaa-49
 hwtacacs-server authentication 10.100.200.49 49
 hwtacacs-server authorization 10.100.200.49 49
 hwtacacs-server shared-key cipher 123-my_tacacs_key
 hwtacacs-server user-name original
 quit
#
aaa
 authentication-scheme aaa-tacacs
 authentication-mode hwtacacs local
 authorization-scheme aaa-tacacs
 authorization-mode hwtacacs local
 quit
#
aaa
 domain example.org
 authentication-scheme aaa-tacacs
 authorization-scheme aaa-tacacs
 hwtacacs-server aaa-49
 quit
#
aaa
 default-domain admin example.org
 quit
#
user-interface vty 0 4
 authentication-mode aaa
 quit
#
commit
#
return
#

This works and configuration sticks across boots on the NE5000E and NE9000 VRP model.

Verify

Using the display access-user username demo0 command which Domain-name part of the VRP AAA configuration is currently active.

<R108>display access-user username demo0
------------------------------------------------------------------------------
UserID     Username                  Domain-name               IP address
------------------------------------------------------------------------------
26         demo0                     example.org               10.100.250.10
------------------------------------------------------------------------------
Total 1, 1 printed

The configured example.org domain is used for authenticating users on this VRP router.

VRP verification commands

Example VRP commands for configuration troubleshooting showing the current state on the router <R108>. These commands are helpful to configure RBAC or AAA when dealing with VRP.

display access-user

<R108>display access-user
--------------------------------------------------------------------------------
Total users                        : 1
IPv4 users                         : 1
IPv6 users                         : 0
Wait authen-ack                    : 0
Authentication success             : 1
Accounting ready                   : 1
Accounting state                   : 0
Wait accounting-start              : 0
Wait accounting-stop               : 0
--------------------------------------------------------------------------------
Domain-name                        Online-user
--------------------------------------------------------------------------------
default0                           : 0
default1                           : 0
default_admin                      : 1
default                            : 0
--------------------------------------------------------------------------------
The used CID table are             :
20
--------------------------------------------------------------------------------

display access-user self

<R108>display access-user self
---------------------------------------------------------------------------
User access index              : 27
State                          : Used
User name                      : demo1
User IP address                : 10.100.250.10
User access type               : Telnet
User authentication type       : Administrator authentication
Current authen method          : HWTACACS authentication
Authen result                  : Success
Current author method          : HWTACACS authorization
Author result                  : Success
Action flag                    : Idle
Authen state                   : Success
Author state                   : Success
Current accounting method      : RADIUS accounting
Access start time              : 2026-01-29 19:09:05+01:00
Accounting start time          : 2026-01-29 19:09:05+01:00
Accounting state               : Start accounting failed
User group name                : system-ug
Current author cmd method      : Local
---------------------------------------------------------------------------

display access-user username

<R108>display access-user username demo0
------------------------------------------------------------------------------
UserID     Username                  Domain-name               IP address
------------------------------------------------------------------------------
9          demo0                     default_admin             10.100.250.10
------------------------------------------------------------------------------

display access-user ?

<R108>display access-user ?
  domain        Domain
  ip-address    IP address
  ipv6-address  IPv6 address
  self          The information of myself
  user-id       User ID
  username      User name, in form of 'user@domain'. If the user already exists,
                do not check the minimum length of username
  |             Matching output
  >             Redirect the output to a file
  >>            Redirect the output to a file in append mode
  <cr>

display hwtacacs current-status

Display the TACACS+ status on VRP

<R108>display hwtacacs current-status
-------------------------------------------------
HWTACACS service status    : Enabled
Total templates configured : 1
Total servers configured   : 2
------------------------------------------------

display hwtacacs-server template

<R108>display hwtacacs-server template
-------------------------------------------------------------
Template name                          : aaa-49
Template ID                            : 0
Primary authentication server          : 10.100.200.49-49:-
Primary authorization server           : 10.100.200.49-49:-
Primary accounting server              : 0.0.0.0-0:-
Primary common server                  : 0.0.0.0-0:-
Current authentication server          : 10.100.200.49-49:-
Current authorization server           : 10.100.200.49-49:-
Current accounting server              : 0.0.0.0-0:-
Source IP address                      : 10.100.100.108
Shared key                             : ****************
Quiet interval (min)                   : 5
Response timeout interval (sec)        : 5
Domain included                        : Original
Secondary authentication server count  : 0
Secondary authorization server count   : 0
Secondary accounting server count      : 0
Secondary common server count          : 0
------------------------------------------------------------

display user interface

In example below specifically the VTY 0 interface:

<R108>display user-interface vty 0
  Idx  Type     Tx/Rx      Modem Privi ActualPrivi Auth  Int
  34   VTY 0               -     0     -           A     -
  +    : Current UI is active.
  F    : Current UI is active and work in async mode.
  Idx  : Absolute index of UIs.
  Type : Type and relative index of UIs.
  Privi: The privilege of UIs.
  ActualPrivi: The actual privilege of user-interface.
  Auth : The authentication mode of UIs.
      A: Authenticate use AAA.
      P: Authenticate use current UI's password.
  Int  : The physical location of UIs.

Summary

At the end what counts is VRP AAA RBAC based profile assigning works using TACACS+NG.

The TACACS+NG RBAC based AAA works. Find the vendor-specific AV pair and configure it in your TACACS+ daemon. This works the same for Aruba ClearPass and Cisco's ISE as of for every other TACACS+ daemon implementation. The configuration process is different, but the outcome or the result MUST be the same.

See also

Expand this TACACS+NG setup to use LDAP and LDAPS, as external DB for user and group related user settings:

• 01 - TACACS+NG and LDAP authentication
• 02 - TACACS+NG and LDAP(S) authentication

References

Not sure the references will stick a long time, vendors documentation links go away with time. Reason for Naming URL's with search terms, so in case URL goes away you still can search using given URL naming:

• Event-driven servers - TAC_PLUS-NG server project
• NetEngine - Understanding HWTACACS-based AAA
• NetEngine Configuration Guide - AAA and User Management Configuration (Administrative Users)