Can a single ACS server be used for both TACACS and RADIUS authentication for a single device? For example on an access point I have TACACS pointed to a production 3.3 ACS server for admin authentication and RADIUS pointed to a lab 4.0 ACS server for VLAN assignment using RADIUS. Can I point both RADIUS and TACACS to the same server for both admin terminal auth and 802.1x auth? And segregate the access of each by the groups on ACS? These groups are dynamically mapped to windows domain groups also, if that matters any. If I point them both at the same ACS server it appears that all authenticated users are able to access the console/terminal.
Here's the aaa setup lines:
aaa new-model
aaa group server radius rad_eap
server 192.168.28.60 auth-port 1645 acct-port 1646
aaa group server tacacs+ tac_auth
server 192.168.28.54
aaa authentication login console line
aaa authentication login eap_methods group rad_eap
aaa authentication login admin_auth group tac_auth local enable
tacacs-server host 192.168.28.54
tacacs-server key 7 <removed>
radius-server host 192.168.28.60 auth-port 1645 acct-port 1646 key 7 <removed>
dot11 ssid <removed>
vlan 12
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa
line con 0
exec-timeout 0 0
login authentication admin_auth
password 7 <removed>
line vty 0 4
exec-timeout 0 0
password 7 <removed>
login authentication admin_auth
transport input ssh
line vty 5 15
password 7 <removed>
login authentication admin_auth
transport input ssh
