“Allowing ten network engineers to manage core hospital switches using a shared local admin password is a massive compliance failure. Centralized TACACS+ AAA enforces individual domain authentication and logs every single CLI command executed in production.”

In September 2008, during my On-the-Job Training (OJT) Network Administrator role at HCL Infosystems, I was responsible for day-to-day operations at Artemis Hospital in Gurgaon.

The hospital’s network comprised 50 Cisco Catalyst 3560/3750 core and access switches, Cisco Aironet 1242 wireless access points, and Cisco ASA 5510 firewalls.

Despite state-of-the-art medical equipment, network management security was stuck in the dark ages.

All 50 Cisco switches were managed using a shared local enable password:

admin@artemis2008.

Ten network engineers, system admins, and third-party contractors had the password written in plaintext files on their laptops.

---

The Shared Password Audit Failure

Using shared passwords meant zero accountability.

When a late-night configuration change accidentally disabled a port-channel trunk to the ICU switch stack, the IT Manager opened the switch syslog logs to find out who made the mistake.

The log line told him nothing:

# Cisco Catalyst Switch Syslog Output:
%SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.10.45)

Because everyone logged in as admin, it was impossible to prove which engineer had executed the command.

Wireless security was even more dangerous. Medical workstations, doctors’ personal laptops, and hospital visitors all connected to a single unencrypted wireless network using a shared WPA-Personal passphrase (ArtemisGuest2008).

Visitor laptops on the guest Wi-Fi were actively scanning internal hospital IP addresses, probing sensitive patient record servers over open airwaves.

The hospital’s HIPAA and ISO security audit was two weeks away.

---

The Mess: The Locked-Out Emergency Switch

To solve the wireless intrusion risk, a junior technician attempted to deploy MAC address filtering on the Cisco Aironet access points manually.

He manually typed 200 allowed MAC addresses into the access point GUI.

He made a typo on the last entry, hit Apply, and locked out every mobile doctor’s tablet in the Emergency Room simultaneously.

Because he hadn’t configured centralized TACACS+ accounting or configuration backups, it took three hours to manually console into 15 access points and clear the corrupted MAC filter list.

Managing security manually across individual access points and switches was unscalable. We needed centralized AAA authentication.

---

The Solution: Cisco Secure ACS 4.0 TACACS+ & WPA2-Enterprise

We deployed Cisco Secure ACS 4.0 (Access Control Server) on a dedicated server to centralize AAA (Authentication, Authorization, and Accounting) for all network equipment and wireless users.

# Artemis Hospital Centralized AAA Architecture

1. **TACACS+ Switch Administration:** Every SSH/Telnet connection authenticates against Active Directory domain user IDs (`sachin.sharma`). ACS authorizes specific CLI command levels (Level 1 vs Level 15).
2. **Real-Time Command Accounting:** Every command typed in the CLI (`configure terminal`, `interface`, `shutdown`) is logged to ACS audit logs with a timestamp and user ID.
3. **WPA2-Enterprise Wireless (Aironet APs):** 802.1X RADIUS authentication for medical staff via Active Directory, while Guest Wi-Fi is anchored to an isolated VLAN on a Cisco ASA 5510 DMZ subinterface.

# Cisco Switch TACACS+ AAA Configuration for Cisco ACS 4.0
tacacs-server host 192.168.10.5 key SecretTacacsKey2008
!
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+

The Critical Local Fallback Rule

To prevent switch lockouts if the primary TACACS+ server went offline during a server crash or network cut, we configured Local Fallback:

# Emergency Local Fallback Account (Active ONLY if TACACS+ Server is Dead)
username emergency-admin privilege 15 secret 0 LocalFailoverPass2008!
aaa authentication login default group tacacs+ local

If the switch lost connectivity to Cisco ACS (192.168.10.5), it automatically fell back to the local emergency-admin account, ensuring engineers were never locked out of core switches during a crisis.

---

The Impact

• 100% Command Accountability: Logged 100% of CLI commands across 50 core switches to individual Active Directory user accounts.
• WPA2-Enterprise Airwave Isolation: Completely isolated Guest Wi-Fi onto a dedicated ASA DMZ subinterface while securing medical laptops via 802.1X RADIUS.
• Audit Compliance: Passed the healthcare regulatory audit with zero identity non-compliance flags.

Key Takeaway

Enforce Individual TACACS+ Command Accounting on Core Network Appliances.

Never allow network engineers to manage enterprise switches using shared local admin passwords. Deploy Cisco ACS / ISE TACACS+ to centralize authentication against Active Directory, log every CLI command executed in production for compliance auditability, and configure strict local fallback accounts for emergency access during server outages.

---

Architecture and decisions: mine. Debugging sessions at odd hours: mine. AI assistance: structure, syntax, first draft. — Sachin