portnox/portnox-tacacs repository overview

⁠Portnox local TACACS+ server

The Portnox local TACACS+ server is a component required to use Portnox Cloud TACACS+ functionality. Unlike RADIUS, Portnox Cloud does not offer a cloud-only TACACS+ option, so without this container (or the equivalent virtual machine), you cannot use Portnox Cloud to manage TACACS+ devices. The container runs in your local network using host network mode, accepts TACACS+ connections from your NAS devices, and lets you manage them using TACACS+ commands as configured in Portnox Cloud.

TACACS+ is used for administrative access to network devices such as routers, switches, and firewalls, separately from RADIUS, which is used for network access by end-user and IoT devices. The local TACACS+ server identifies each NAS device by its source IP address, then sends the request to Portnox Cloud using an encrypted TLS connection. The Portnox Cloud back-end checks the policies defined in portal to decide what the administrator can see and do on the device, including which commands they are allowed to run, and logs the session.

You can run this Docker container by copying the ready-made command directly from Portnox Cloud, or by copying only the environment variables and building a custom command yourself. We recommend a custom command for more experienced users, since it allows options such as persistent cache storage.

⁠Deploy on Linux

Copy the following three values from your Portnox Cloud tenant and export them as environment variables:

export TACACS_GATEWAY_ORG_ID=copied_TACACS_GATEWAY_ORG_ID
export TACACS_GATEWAY_PROFILE=copied_TACACS_GATEWAY_PROFILE
export TACACS_GATEWAY_TOKEN=copied_TACACS_GATEWAY_TOKEN

Then run the container. Host network mode is required, since the server identifies NAS devices by their source IP address. The -v flag below mounts a persistent volume, so any cached data survive container restarts instead of being held only in memory:

sudo docker run -d --network host -p 49:49 \
  --name portnox-tacacs --restart=always \
  -v portnox-tacacs-data:/data \
  -e TACACS_GATEWAY_PROFILE=$TACACS_GATEWAY_PROFILE \
  -e TACACS_GATEWAY_ORG_ID=$TACACS_GATEWAY_ORG_ID \
  -e TACACS_GATEWAY_TOKEN=$TACACS_GATEWAY_TOKEN \
  portnox/portnox-tacacs:latest

⁠Known limitations

Do not place NAS devices behind a NAT relative to the local TACACS+ server, since the server identifies devices by source IP address, and a NAT would make several devices appear identical. If a NAT is unavoidable, encapsulate traffic between your NAS devices and the container inside a VPN tunnel to avoid NAT traversal issues.

You can run this container in a cloud environment, but only if your NAS devices are on the same network as the cloud environment (for example, connected over a site-to-site VPN or a direct connection into the same virtual network), and only if the cloud service supports host networking. Most managed container services, including Azure Container Instances and AWS Fargate, do not support host networking, so the container cannot see the real source IP address of incoming connections and cannot identify NAS devices correctly.

⁠Updating

Update the container by redeploying it manually, or automate updates with the portnox-autoupdate container⁠.

⁠Full documentation

For full documentation, see: docs.portnox.com⁠.