Dell N3200-ON Networking N-Series Switches User Guide version 6.8.0 - Page 264

The TACACS+ server can do the authentication itself, or redirect the request to another back-end device. All sensitive information is encrypted and the shared secret is never passed over the network; it is used only to encrypt the data. Which TACACS+ Attributes Does the Switch Support? Table 9-7 lists the TACACS+ attributes that the switch supports and indicates whether the authorization or accounting service supports sending or receiving the attribute. The authentication service does not use attributes. The following attributes can be configured on the TACACS+ server(s) when utilizing the switch TACACS+ service. Table 9-7. Supported TACACS+ Attributes Attribute Name cmd cmd-arg elapsed-time priv-lvl protocol roles service=shell start-time stop-time Exec Authorization both (optional) Command Authorization sent sent received both (optional) both sent Accounting sent sent sent sent sent sent Dynamic ACL Overview NOTE: This feature is only supported in 802.1X-enabled configurations. Dynamic ACLs allow operators to administer bespoke network access policies from a central location (the RADIUS server). Access policies are enforced via the use of ACLs or DiffServ policy installed for the duration of the user session. Unique policies can be assigned based upon the user credentials/location/time of day and other information presented to the RADIUS server during the authentication process. The benefit to the end user is that the policy can follow the user around the network, regardless of 264 Authentication, Authorization, and Accounting