show tacacs

show TACACS information.




Command Mode


Command Output

The show tacacs command displays the following information:

Output field


Global Status

global enable

Displays if the TACACS+ feature is enabled globally.

authentication enabled for

Displays which application is authenticated by TACACS+. The possibilities are CLI, web, or all.

accounting enabled for

Displays if accounting is enabled. You can only enable accounting for CLI. By default, accounting is not enabled.


Displays if authorization is enabled.

User privilege levels set for command authorization

Displays the privilege levels set for command authorization. When you configure command authorization for a particular level, all commands that you execute are sent to the TACACS+ server for authorization. The device can only execute the commands the TACACS+ server authorizes.

The user privilege levels are:

  • 0: denied access

  • 1: read only (ro) access

  • 2: Layer 1 read and write (l1) access

  • 3: Layer 2 read and write (l2) access

  • 4: Layer 3 read and write (l3) access

  • 5: read and write (rw) access

  • 6: read and write all (rwa) access

  • 7-14: denied access

  • 15: read and write all (rwa) access



Displays the priority of the TACACS+ server. The switch attempts to use the primary server first, and the secondary server second.


Displays the connection status between the server and the switch – connected or not connected.


Displays as ****** instead of the actual key. The key is secret and is not visible.


Displays the TCP port used to establish the connection to the server. The default port is 49.

IP address

Displays the IP address for the primary and secondary TACACS+ servers.


Displays the period of time, in seconds, the switch waits for a response from the TACACS+ daemon before it times out and declares an error. The default is 10 seconds.


Displays if a single open connection is maintained between the switch and TACACS+ daemon, or if the switch opens and closes the TCP connection to the TACACS+ daemon each time they communicate. The default is false, which means the device does not maintain the single open connection.