Ok, here is how it is going to work:
1. On the Cisco access-server you must have configured Tacacs authentication for the incoming PPP calls.
You do not need to enter any users inside the Cisco access-server. When an incoming call passes into the Cisco access-server it will collect from customer his username and password and will send an authentication request to the Tacacs server. In the Tacacs ACS server you will configure usernames and passwords.
Here is an example configuration for the Cisco access-server:
interface Group-Async1
ip unnumbered FastEthernet0/
no ip directed-broadcast
encapsulation ppp
keepalive 10
async default routing
async dynamic address
async dynamic routing
async mode dedicated
peer default ip address pool POOL
no cdp enable
ppp authentication chap (pap - chap, whatever you like)
group-range 10 20 (line numbers)
line 10 20
session-timeout 5
autoselect during-login
autoselect ppp
modem In
transport input telnet
escape-character NONE
flowcontrol hardware
aaa new-model
aaa authentication login default line tacacs+
aaa authentication ppp default tacacs+
aaa authentication ppp ppp_list tacacs+
aaa authorization network default tacacs+
aaa accounting network default start-stop tacacs+
tacacs-server host XXX.XXX.XXX.XXX
tacacs-server key **********
That is all at the Cisco side.
P.S. Greetings from visp.net.lb :)
