AAA

AAA (Authentication, Authorization, and Accounting) on NX-OS encompasses RADIUS and TACACS+ server integration for centralized device management access, local user account management with role-based access control, and AAA method configuration for login authentication, command authorization, and accounting. TACACS+ configuration includes shared secret keys with encryption, timeout/retry/deadtime settings, source interface binding, individual server definitions with per-server authentication protocols (PAP, CHAP, MSCHAP, MSCHAPv2, ASCII), idle-time testing, and server groups with VRF-aware source interfaces and server member references. RADIUS configuration includes global shared secret keys, timeout/retransmit/deadtime settings, source interface binding, secure mode (TLS/DTLS), periodic server monitoring credentials, individual server definitions with authentication/accounting ports and usage, per-server TLS/DTLS client trustpoints, and server groups with VRF, source interface, deadtime, and server member references. User management provides password strength policies, passphrase length/lifetime/gracetime/warntime constraints, maximum concurrent login sessions, and individual user accounts with role assignments, password encryption types (clear, encrypt, pbkdf2, scrypt), account expiration, and shell type selection. Custom RBAC roles define numbered permit/deny rules that grant read or read-write access to features, feature groups or SNMP OIDs, or match command strings, plus VLAN, interface and VRF policies that deny access to all but the permitted resources; role feature groups bundle features for use in role rules. Authentication settings control default and console login methods with group-based fallback, authorization defines config and exec command methods, and accounting tracks command usage via server groups.

AAA (Authentication, Authorization, and Accounting) on NX-OS encompasses TACACS+ server integration for centralized device management access, local user account management with role-based access control, and AAA method configuration for login authentication, command authorization, and accounting. TACACS+ configuration includes shared secret keys with encryption, timeout/retry/deadtime settings, source interface binding, individual server definitions with per-server authentication protocols (PAP, CHAP, MSCHAP, MSCHAPv2, ASCII), idle-time testing, and server groups with VRF-aware source interfaces and server member references. User management provides password strength policies, secure mode, passphrase length/lifetime/gracetime/warntime constraints, maximum concurrent login sessions, and individual user accounts with role assignments, password encryption types (clear, encrypt, pbkdf2, scrypt), account expiration, and shell type selection. Authentication settings control default and console login methods with group-based fallback, authorization defines config and exec command methods, and accounting tracks command usage via server groups.

Diagram

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
aaa	Class	aaa	No

aaa (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
radius	Class	radius	No
tacacs	Class	tacacs	No
users	Class	users	No
role_feature_groups	List	role_feature_groups	No
roles	List	roles	No
authentication	Class	authentication	No
authorization	List	authorization	No
accounting	Class	accounting	No

aaa (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
tacacs	Class	tacacs	No
users	Class	users	No
authentication	Class	authentication	No
authorization	List	authorization	No
accounting	Class	accounting	No

radius (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
deadtime	Integer	min: 0, max: 1440	No
key	String		No
key_encryption	Choice	0, 6, 7	No
retransmit	Integer	min: 0, max: 5	No
secure	Choice	tls, dtls	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
timeout	Integer	min: 1, max: 60	No
test_idle_time	Integer	min: 0, max: 1440	No
test_password	String		No
test_password_type	Choice	0, 7	No
test_username	String		No
servers	List	servers	No
server_groups	List	server_groups	No

tacacs (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
deadtime	Integer	min: 0, max: 1440	No
key	String		No
key_encryption	Choice	0, 6, 7	No
retries	Integer	min: 0, max: 5	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
timeout	Integer	min: 1, max: 60	No
servers	List	servers	No
server_groups	List	server_groups	No

users (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
password_strength_check	Boolean	true, false	No
service_password_recovery	Boolean	true, false	No
max_logins	Integer	min: 0, max: 7	No
userpassphrase	Class	userpassphrase	No
accounts	List	accounts	No

role_feature_groups (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
features	List	String	No

roles (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
rules	List	rules	No
vlan_policy	Class	vlan_policy	No
interface_policy	Class	interface_policy	No
vrf_policy	Class	vrf_policy	No

authentication (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
default_role	Choice	no-login, assign-default-role	No
radius_directed_request	Boolean	true, false	No
tacacs_directed_request	Boolean	true, false	No
login_default_groups	List	String	No
login_default_fallback	Boolean	true, false	No
login_default_local	Boolean	true, false	No
login_default_none	Boolean	true, false	No
login_default_error_enable	Boolean	true, false	No
login_default_invalid_username_log	Boolean	true, false	No
login_console_groups	List	String	No
login_console_fallback	Boolean	true, false	No
login_console_local	Boolean	true, false	No
login_console_none	Boolean	true, false	No
login_console_error_enable	Boolean	true, false	No
login_console_invalid_username_log	Boolean	true, false	No

authorization (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
command_type	Choice	config-commands, commands	Yes
groups	List	String	No
none	Boolean	true, false	No
local	Boolean	true, false	No

accounting (nxos.devices.configuration.aaa)

Name	Type	Constraint	Mandatory	Default Value
groups	List	String	No
none	Boolean	true, false	No
local	Boolean	true, false	No

servers (nxos.devices.configuration.aaa.radius)

Name	Type	Constraint	Mandatory	Default Value
host	String		Yes
key	String		No
key_encryption	Choice	0, 6, 7	No
auth_port	Integer	min: 0, max: 65535	No
acct_port	Integer	min: 0, max: 65535	No
authentication	Boolean	true, false	No
accounting	Boolean	true, false	No
timeout	Integer	min: 0, max: 60	No
retransmit	Integer	min: 0, max: 5	No
test_idle_time	Integer	min: 0, max: 1440	No
test_password	String		No
test_password_type	Choice	0, 7	No
test_username	String		No
tls_client_trustpoint	String		No
tls_idle_timeout	Integer	min: 60, max: 600	No
dtls_client_trustpoint	String		No
dtls_idle_timeout	Integer	min: 60, max: 600	No

server_groups (nxos.devices.configuration.aaa.radius)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
deadtime	Integer	min: 0, max: 1440	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
use_vrf	String		No
servers	List	servers	No

servers (nxos.devices.configuration.aaa.tacacs)

Name	Type	Constraint	Mandatory	Default Value
host	String		Yes
test_authentication_protocol	Choice	pap, chap, mschap, mschapv2, ascii	No
key	String		No
key_encryption	Choice	0, 6, 7	No
test_idle_time	Integer	min: 0, max: 1440	No
test_password	String		No
test_password_type	Choice	0, 7	No
test_username	String		No
port	Integer	min: 1, max: 65535	No
retries	Integer	min: 0, max: 5	No
single_connection	Boolean	true, false	No
timeout	Integer	min: 0, max: 60	No

server_groups (nxos.devices.configuration.aaa.tacacs)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
deadtime	Integer	min: 0, max: 1440	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
use_vrf	String		No
servers	List	servers	No

server_groups (nxos.devices.configuration.aaa.tacacs)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
deadtime	Integer	min: 0, max: 1440	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
vrf	String		No
servers	List	servers	No

userpassphrase (nxos.devices.configuration.aaa.users)

Name	Type	Constraint	Mandatory	Default Value
min_length	Integer	min: 0, max: 65535	No
max_length	Integer	min: 0, max: 65535	No
default_lifetime	Integer	min: 0, max: 99999	No
default_gracetime	Integer	min: 0, max: 99999	No
default_warntime	Integer	min: 0, max: 99999	No
sequence_alphabet_length	Integer	min: 0, max: 10	No
sequence_keyboard_length	Integer	min: 0, max: 10	No
min_unique	Integer	min: 0, max: 10	No

accounts (nxos.devices.configuration.aaa.users)

Name	Type	Constraint	Mandatory	Default Value
username	String		Yes
expiration	String		No
expires	Boolean	true, false	No
password	String		No
password_encryption_type	Choice	0, 5, pbkdf2, scrypt	No
shelltype	Choice	vsh, bash	No
sshkey	String		No
roles	List	roles	No

accounts (nxos.devices.configuration.aaa.users)

Name	Type	Constraint	Mandatory	Default Value
username	String		Yes
expiration	String		No
expires	Boolean	true, false	No
password	String		No
password_encryption_type	Choice	0, 5, pbkdf2, scrypt	No
shelltype	Choice	vsh, bash	No
roles	List	roles	No

rules (nxos.devices.configuration.aaa.roles)

Name	Type	Constraint	Mandatory	Default Value
number	Integer	min: 1, max: 256	Yes
action	Choice	permit, deny	Yes
permission	Choice	read, read-write	No
command	String		No
feature	String		No
feature_group	String		No
oid	String		No

vlan_policy (nxos.devices.configuration.aaa.roles)

Name	Type	Constraint	Mandatory	Default Value
deny	Boolean	true, false	No
permit_vlans	Class	permit_vlans	No

interface_policy (nxos.devices.configuration.aaa.roles)

Name	Type	Constraint	Mandatory	Default Value
deny	Boolean	true, false	No
permit_interfaces	List	permit_interfaces	No

vrf_policy (nxos.devices.configuration.aaa.roles)

Name	Type	Constraint	Mandatory	Default Value
deny	Boolean	true, false	No
permit_vrfs	List	String	No

servers (nxos.devices.configuration.aaa.radius.server_groups)

Name	Type	Constraint	Mandatory	Default Value
host	String		Yes

servers (nxos.devices.configuration.aaa.tacacs.server_groups)

Name	Type	Constraint	Mandatory	Default Value
host	String		Yes
order	Integer	min: 0, max: 16	No

roles (nxos.devices.configuration.aaa.users.accounts)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes

permit_vlans (nxos.devices.configuration.aaa.roles.vlan_policy)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

permit_interfaces (nxos.devices.configuration.aaa.roles.interface_policy)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	ethernet, loopback, mgmt, port-channel	Yes
interface_id	Any	String or Integer[min: 0]	Yes

ranges (nxos.devices.configuration.aaa.roles.vlan_policy.permit_vlans)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes

Examples

Example 1: TACACS+ with single server and basic user account

nxos:
  devices:
    - name: LEAF1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 10
            source_interface_type: mgmt
            source_interface_id: "0"
            servers:
              - host: 10.50.100.10
                key: "T@c@csK3y!"
                key_encryption: "7"
          users:
            password_strength_check: true
            accounts:
              - username: admin
                password: "N3tw0rkAdm!n"
                password_encryption_type: scrypt
                roles:
                  - name: network-admin

Example 2: Redundant TACACS+ with server group and multiple user accounts with RBAC and SSH public key login

nxos:
  devices:
    - name: SPINE1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 15
            source_interface_type: mgmt
            source_interface_id: "0"
            key: "Gl0b@lT@c@cs"
            key_encryption: "7"
            servers:
              - host: 10.50.100.10
                timeout: 3
              - host: 10.50.100.11
                timeout: 3
            server_groups:
              - name: TACACS_SERVERS
                use_vrf: management
                source_interface_type: mgmt
                source_interface_id: "0"
                servers:
                  - host: 10.50.100.10
                    order: 1
                  - host: 10.50.100.11
                    order: 2
          users:
            password_strength_check: true
            max_logins: 4
            accounts:
              - username: admin
                password: "S3cur3P@ss!"
                password_encryption_type: scrypt
                roles:
                  - name: network-admin
              - username: noc-operator
                password: "N0cR3@d0nly!"
                password_encryption_type: scrypt
                roles:
                  - name: network-operator
              - username: backup-svc
                password: "B@ckupSvc2025!"
                password_encryption_type: scrypt
                shelltype: bash
                sshkey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7r1TEul1XD1s6fNl5XuyzbTj507k2Q8gUlVoK43qUiIr/vDXCeZTdpINlYYU1lvCGgO/EsxijDOpGgs0stQ21BqBcc11p2RauN8Mnpx/7OHYgrLaMMTMfQeKVBfrpooB0Oz07UayRsFA8BNy2CnNuFdRNUiYLU0rmAnox9NZwEX213C6uEg3XnLJcdzX7I4VS0B7Joj30WDTAOilkPZ3C35WfyBS7N/d4/u7ZejHvLyGbdB70uhCyz4oHQuDCxF3MEchc5nDImi2+b1OFyWrY2W+soMhkTh7vfsmxNcLHWNae7JLl/kJ2ztSzUZH8avOuuMEid0IhHbvSLYvEy/gf backup-svc"
                roles:
                  - name: network-operator

Example 3: Full AAA with authentication protocols, idle testing, passphrase policy, and account expiration

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 20
            retries: 2
            source_interface_type: mgmt
            source_interface_id: "0"
            key: "F@br!cT@c@cs"
            key_encryption: "7"
            servers:
              - host: 10.50.100.10
                test_authentication_protocol: chap
                single_connection: true
                test_idle_time: 5
                test_username: test
                test_password: "t3stP@ss"
                test_password_type: "7"
              - host: 10.50.100.11
                test_authentication_protocol: chap
                single_connection: true
                test_idle_time: 5
                test_username: test
                test_password: "t3stP@ss"
                test_password_type: "7"
            server_groups:
              - name: TACACS_PRIMARY
                use_vrf: management
                source_interface_type: mgmt
                source_interface_id: "0"
                deadtime: 10
              - name: TACACS_FALLBACK
                use_vrf: management
                source_interface_type: mgmt
                source_interface_id: "0"
          users:
            password_strength_check: true
            userpassphrase:
              min_length: 12
              max_length: 127
              default_lifetime: 180
              default_gracetime: 7
              default_warntime: 14
              sequence_alphabet_length: 3
              sequence_keyboard_length: 3
            max_logins: 3
            accounts:
              - username: admin
                password: "Adm!nP@ss2025"
                password_encryption_type: scrypt
                roles:
                  - name: network-admin
              - username: auditor
                password: "Aud!t0rAcc3ss"
                password_encryption_type: scrypt
                expires: true
                expiration: "2026-12-31"
                roles:
                  - name: network-operator

Example 4: AAA authentication, authorization, and accounting with TACACS+ server groups

nxos:
  devices:
    - name: LEAF1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 10
            source_interface_type: mgmt
            source_interface_id: "0"
            servers:
              - host: 10.50.100.10
              - host: 10.50.100.11
            server_groups:
              - name: TACACS_PRIMARY
                use_vrf: management
                servers:
                  - host: 10.50.100.10
                    order: 1
                  - host: 10.50.100.11
                    order: 2
          authentication:
            default_role: no-login
            tacacs_directed_request: true
            login_default_groups:
              - TACACS_PRIMARY
            login_default_fallback: true
            login_default_local: true
            login_default_error_enable: true
            login_default_invalid_username_log: true
            login_console_groups:
              - TACACS_PRIMARY
            login_console_local: true
          authorization:
            - command_type: config-commands
              groups:
                - TACACS_PRIMARY
              local: true
            - command_type: commands
              groups:
                - TACACS_PRIMARY
              local: true
          accounting:
            groups:
              - TACACS_PRIMARY
            local: true

Example 5: RADIUS servers with server monitoring and a server group used for login authentication

nxos:
  devices:
    - name: LEAF1
      configuration:
        aaa:
          radius:
            key: "R@d!usK3y"
            key_encryption: "0"
            timeout: 10
            retransmit: 3
            deadtime: 5
            source_interface_type: mgmt
            source_interface_id: "0"
            test_username: monitor
            test_password: "M0n!t0r"
            test_password_type: "0"
            test_idle_time: 10
            servers:
              - host: 10.50.100.20
                key: "R@d!usK3y"
                key_encryption: "0"
                auth_port: 1812
                acct_port: 1813
                authentication: true
                accounting: true
                timeout: 5
                retransmit: 2
              - host: 10.50.100.21
                key: "R@d!usK3y"
                key_encryption: "0"
                authentication: true
                test_username: monitor
                test_password: "M0n!t0r"
                test_password_type: "0"
                test_idle_time: 5
            server_groups:
              - name: RADIUS_SERVERS
                use_vrf: management
                source_interface_type: mgmt
                source_interface_id: "0"
                deadtime: 5
                servers:
                  - host: 10.50.100.20
                  - host: 10.50.100.21
          authentication:
            radius_directed_request: true
            login_default_groups:
              - RADIUS_SERVERS
            login_default_local: true

Example 6: Custom RBAC role with feature group, command rules and resource policies

nxos:
  devices:
    - name: LEAF1
      configuration:
        aaa:
          role_feature_groups:
            - name: MONITORING
              features:
                - snmp
                - interface
          roles:
            - name: NOC-OPERATOR
              description: NOC operator role
              rules:
                - number: 10
                  action: permit
                  permission: read-write
                  feature_group: MONITORING
                - number: 20
                  action: permit
                  permission: read
                - number: 30
                  action: deny
                  command: reload *
              vlan_policy:
                deny: true
                permit_vlans:
                  ids:
                    - 100
                  ranges:
                    - from: 200
                      to: 210
              interface_policy:
                deny: true
                permit_interfaces:
                  - interface_type: ethernet
                    interface_id: "1/10"
                  - interface_type: port-channel
                    interface_id: 10
              vrf_policy:
                deny: true
                permit_vrfs:
                  - PROD
          users:
            accounts:
              - username: noc
                password: "N0cOp3r@t0r!"
                password_encryption_type: scrypt
                roles:
                  - name: NOC-OPERATOR

Examples

Example 1: TACACS+ with single server and basic user account

nxos:
  devices:
    - name: LEAF1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 10
            source_interface_type: mgmt
            source_interface_id: "0"
            servers:
              - host: 10.50.100.10
                description: Primary TACACS Server
                key: "T@c@csK3y!"
                key_encryption: "7"
          users:
            password_strength_check: true
            accounts:
              - username: admin
                description: Network Admin
                password: "N3tw0rkAdm!n"
                password_encryption_type: scrypt
                roles:
                  - name: network-admin

Example 2: Redundant TACACS+ with server group and multiple user accounts with RBAC

nxos:
  devices:
    - name: SPINE1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 15
            source_interface_type: mgmt
            source_interface_id: "0"
            key: "Gl0b@lT@c@cs"
            key_encryption: "7"
            servers:
              - host: 10.50.100.10
                description: Primary TACACS Server
                timeout: 3
              - host: 10.50.100.11
                description: Secondary TACACS Server
                timeout: 3
            server_groups:
              - name: TACACS_SERVERS
                description: Production TACACS+ Server Group
                vrf: management
                source_interface_type: mgmt
                source_interface_id: "0"
                servers:
                  - host: 10.50.100.10
                    order: 1
                  - host: 10.50.100.11
                    order: 2
          users:
            password_strength_check: true
            password_secure_mode: true
            max_logins: 4
            accounts:
              - username: admin
                description: Primary Admin
                password: "S3cur3P@ss!"
                password_encryption_type: scrypt
                roles:
                  - name: network-admin
              - username: noc-operator
                description: NOC Read-Only Operator
                password: "N0cR3@d0nly!"
                password_encryption_type: scrypt
                roles:
                  - name: network-operator
                    privilege_type: read-priv
              - username: backup-svc
                description: Backup Service Account
                password: "B@ckupSvc2025!"
                password_encryption_type: scrypt
                shell_type: bash
                roles:
                  - name: network-operator

Example 3: Full AAA with authentication protocols, idle testing, passphrase policy, and account expiration

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 20
            retries: 2
            source_interface_type: mgmt
            source_interface_id: "0"
            key: "F@br!cT@c@cs"
            key_encryption: "7"
            servers:
              - host: 10.50.100.10
                description: DC1 Primary TACACS Server
                authentication_protocol: chap
                single_connection: true
                test_idle_time: 5
                test_username: test
                test_password: "t3stP@ss"
                test_password_type: "7"
              - host: 10.50.100.11
                description: DC1 Secondary TACACS Server
                authentication_protocol: chap
                single_connection: true
                test_idle_time: 5
                test_username: test
                test_password: "t3stP@ss"
                test_password_type: "7"
            server_groups:
              - name: TACACS_PRIMARY
                description: Primary TACACS+ Server Group
                vrf: management
                source_interface_type: mgmt
                source_interface_id: "0"
                deadtime: 10
              - name: TACACS_FALLBACK
                description: Fallback TACACS+ Server Group
                vrf: management
                source_interface_type: mgmt
                source_interface_id: "0"
          users:
            password_strength_check: true
            password_secure_mode: true
            userpassphrase:
              min_length: 12
              max_length: 127
              default_lifetime: 180
              default_gracetime: 7
              default_warntime: 14
              sequence_alphabet_length: 3
              sequence_keyboard_length: 3
            max_logins: 3
            accounts:
              - username: admin
                description: Primary Admin
                password: "Adm!nP@ss2025"
                password_encryption_type: scrypt
                roles:
                  - name: network-admin
              - username: auditor
                description: Security Auditor
                password: "Aud!t0rAcc3ss"
                password_encryption_type: scrypt
                expires: true
                expiration: "2026-12-31"
                roles:
                  - name: network-operator
                    privilege_type: read-priv

Example 4: AAA authentication, authorization, and accounting with TACACS+ server groups

nxos:
  devices:
    - name: LEAF1
      configuration:
        aaa:
          tacacs:
            timeout: 5
            deadtime: 10
            source_interface_type: mgmt
            source_interface_id: "0"
            servers:
              - host: 10.50.100.10
              - host: 10.50.100.11
            server_groups:
              - name: TACACS_PRIMARY
                vrf: management
                servers:
                  - host: 10.50.100.10
                    order: 1
                  - host: 10.50.100.11
                    order: 2
          authentication:
            default_role: no-login
            tacacs_directed_request: true
            login_default_groups:
              - TACACS_PRIMARY
            login_default_realm: tacacs
            login_default_fallback: true
            login_default_local: true
            login_default_error_enable: true
            login_default_invalid_username_log: true
            login_console_groups:
              - TACACS_PRIMARY
            login_console_realm: tacacs
            login_console_local: true
          authorization:
            - command_type: config
              groups:
                - TACACS_PRIMARY
              local: true
            - command_type: exec
              groups:
                - TACACS_PRIMARY
              local: true
          accounting:
            groups:
              - TACACS_PRIMARY
            realm: tacacs
            local: true