--- title: 6 TACACS+ Access Manager slug: singleconnect-2-16/SUY_-6-tacacs-access-manager description: This document offers a comprehensive guide on configuring Single Connect and devices to utilize the RADIUS/TACACS+ AAA service. It covers various aspects such as adding new elements, device groups, properties, passwords, subnets, and more. It also include docTags: createdAt: 2020-08-19T15:26:39.000Z --- This section describes how to configure Single Connect and devices to use the RADIUS/TACACS+ AAA service through Single Connect. **Adding a New Element Type ** **** 1\. Log in to Single Connect 2\. Navigate to Device Management > Element Type 3\. Type in the Element Type ID and Element Type Name 4\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/EVxmZcCGVS2ufRTFFxi4N_image.png" size="84" position="center" showCaption="false"} **Adding a New Device Group ** 1\. Log in to Single Connect 2\. Navigate to Device Management > Device Group 3\. Type in device group name and description. 4\. Select the Parent Device Group (Optional) 5\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/Iv5xyk6wOAKpj52sZLDcn_image.png" size="84" position="center" showCaption="false"} **Adding Device Group Properties** 1\. Log in to Single Connect 2\. Navigate to Device Management > Device Group 3\. Right-click the selected group 4\. Click the “Show Properties” button 5\. Set RADIUS/TACACS+ secret as “globalSecretKey” 6\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/GbYKGTb8bEeNqUF_ogHTi_image.png" size="58" position="center" showCaption="false"} **Adding Common Enable Password** Bot/script user groups need to use a common password for enable password in scripts. The *"globalEnabledPassword" *property allows to set a common password for a device group to be used when prompted for enable password. 1\. Log in to Single Connect 2\. Navigate to Device Management > Device Group 3\. Right-click the selected group 4\. Click the “Show Properties” button 5\. Set Common Enable Password as “globalEnablePassword” 6\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/wqlGlR0UgmXqo0mbpa64m_image.png" size="58" position="center" showCaption="false"} **Adding a Subnet** 1\. Log in to the Single Connect Web GUI 2\. Navigate to Device Management > Device Groups 3\. Right-click on the device group to be discovered and select “Add/Edit Subnet” ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/zlcVX4Twtqp9t4bYM7P-L_image.png" size="36" caption="Add SubnetSet subnet information" position="center" showCaption="true"} 4\. Set subnet information ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/eFbZttKNXBoaMIg0WzINT_image.png" size="58" caption="Subnet Info" position="center" showCaption="true"} **Adding Devices with IP Regex** 1\. Log in to the Single Connect Web GUI 2\. Navigate to Device Management > Device Groups 3\. Right-click on the device group to be discovered and select Add/Edit Ip Regex Pattern ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/X_BY0a4KIOAXcz-pxoOVO_image.png" size="32" caption="Add Ip Regex Pattern" position="center" showCaption="true"} 4\. Set allowed/denied IP regex ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/e9ALn8Jj1cUkYQVxX6i4o_image.png" size="54" caption="IP Regex Patterns" position="center" showCaption="true"} **Adding a New Device** 1\. Log in to Single Connect 2\. Navigate to Device Management > Device Inventory 3\. Go to the “New Device Discovery” tab 4\. Type device IP address 5\. Select Access Protocol. SSHv2 can be selected to add devices which use RADIUS/TACACS+ Server for AAA. The default port number can be used, or an admin can define the port number. 6\. Select the Element Type and the Device Group to be assigned 7\. Click “Discover and Add” ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/OJQSe2xWd3eRSG-9EeSll_image.png" size="84" caption="Adding New Device" position="center" showCaption="true"} **Adding a Device Realm** 1\. Log in to Single Connect 2\. Navigate to Device Management > Device Group 3\. Open the "Device Group Realms" tab 4\. Type in the Device Realm Name and select the device Group(s) 5\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/ECwwqICT0hOu6hLfrVEnF_image.png" size="84" position="center" showCaption="false"} **Adding RADIUS/TACACS+ Attribute** 1\. Log in to Single Connect 2\. Navigate to Policy Control > Session Policy 3\. Type in Key (Text before the first space is considered as attribute key. Text between the first and second space is considered as an operand. Text after the second space is considered as the attribute value.) and Description 4\. Select “RADIUS/TACACS+ Attribute” as the Type. 5\. Select element types to add the attribute. 6\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/QKMU3y18F3xHF1oR5yQFp_image.png" size="84" position="center" showCaption="false"} **Example** CISCO IOS Example AVPs cisco-avpair := shell\:priv-lvl=1 Service-Type := NAS-Prompt-User **Adding RADIUS/TACACS+ Policy Key** 1\. Log in to Single Connect 2\. Navigate to Policy Control > Session Policy 3\. Open the "Policy" tab 4\. Type in the Policy Name and Description 5\. Select the "Operation" as Operation Mode 6\. Select the policy key(s) to apply 7\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/Oc2-dWRRRKo4uTffZLwYo_image.png" size="84" position="center" showCaption="false"} **Adding a Policy Realm** 1\. Log in to Single Connect 2\. Navigate to Policy Control > Session Policy 3\. Open the "Policy Realm" tab 4\. Type in Realm Name and Description 5\. Select the Policy Key Group(s) and the Device Realm(s) 6\. Save ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/TK9j-sDdzKB-n6hzXaoYg_image.png" size="82" position="center" showCaption="false"} ### MSCAHPv2 Radius Configuration Please ask consultation from Kron Technical Support **epdestek\@kron.com.tr** **** ### Single Connect Server Configurations Please ask consultation from Kron Technical Support [](https://sc-support@kron.com)**epdestek\@kron.com.tr** **Single Connect GUI Configurations** Single Connect admin should follow the steps below: 1\. Log in to the Single Connect Web GUI. 2\. Create a user and user group. (See also: Managing User and Managing User Group sections in Admin Guide) 3\. Create a device group and add the new device to device group. (See also: Managing Devices) 4\. Create a Device Group Realm with the user group defined at step 2 and the device group defined at step 3 (See also: Managing Devices) 5\. Define the authenticating secret key as, *“globalSecretKey” *in the device group properties. (See also: Adding Device Group Properties in Managing Devices) 6\. Navigate to Administration > Radius 802.1x Config. 7\. Choose an EAP Type (for now only PEAP is available as an EAP type.) 8\. Fill in the Certificate Authority PEM, Certificate Private Key PEM and Certificate Private Key Password fields. (It is not necessary for the information to be correct) ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/ViJk5vuAx1glt-BRClag2_image.png" size="64" caption="802.1x Configuration" position="center" showCaption="true"} 9\. Tick the “Add SC Server to Active Directory” and fill in the necessary fields ::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/BycEJkHHphIvwIs8qjwVc_image.png" size="64" position="center" showCaption="false"}