create authen server_host 172.31.1.1 protocol tacacs+ port 49 key "asdf" timeout 5 retransmit 2
config authen server_group tacacs+ delete server_host 172.31.1.1 protocol tacacs+
create authen server_host 172.31.2.1 protocol tacacs+ port 49 key "qwert" timeout 5 retransmit 2
config authen server_group tacacs+ delete server_host 172.31.2.1 protocol tacacs+
config authen server_group tacacs+ add server_host 172.31.1.1 protocol tacacs+
config authen server_group tacacs+ add server_host 172.31.2.1 protocol tacacs+
config authen_login default method tacacs+ local
config authen_enable default method tacacs+ local_enable
config authen application console login default
config authen application console enable default
config authen application telnet login default
config authen application telnet enable default
config authen application ssh login default
config authen application ssh enable default
config authen application http login default
config authen application http enable default
config authen parameter response_timeout 30
config authen parameter attempt 3
en auth

tac_accs.log:Thu Nov 12 15:08:21 2009   flegontova5-sw-6.mgmt.redcom.net        tty2    172.31.253.51   ivan    accepted   login
tac_accs.log:Thu Nov 12 15:10:40 2009   flegontova5-sw-6.mgmt.redcom.net        tty2    172.31.253.51   enable  rejected   enable
tac_accs.log:Thu Nov 12 15:10:40 2009   flegontova5-sw-6.mgmt.redcom.net        tty2    172.31.253.51   enable  rejected   enable
tac_accs.log:Thu Nov 12 15:10:40 2009   flegontova5-sw-6.mgmt.redcom.net        tty2    172.31.253.51   enable  rejected   enable

tac_accs.log:Fri Nov 13 10:08:35 2009   flegontova5-sw-3.mgmt.redcom.net        tty1    172.31.253.51   ivan    accepted   login
tac_accs.log:Fri Nov 13 10:08:38 2009   flegontova5-sw-3.mgmt.redcom.net        tty1    172.31.253.51   ivan    accepted  enable

group = grp_noc {
    default service = permit
}

group = grp_enable {
}

user = ivan {
    name = "Ivan"
    login = des "XXXXXXXX"
    member = grp_noc
}

user = $enab15$ {
    login = des "XXXXXXXX"
    member = grp_enable
}

host = 172.31.0.0/16 {
    type = cisco
    prompt motd = /usr/local/etc/tacacs/tac_plus.motd
    prompt = "User Access Verification (netanf1)\n\nlogin: "
    permit enable grp_enable, grp_noc, grp_monitoring, grp_maintenance
    deny login *
}

user = enable {
    login = des "XXXXXXXX"
    member = grp_enable
}