It is routing, and I will source it from the loopback interface.

Is there a command I need to input for exec authentication?

Thanks

You can enable exec 'authorization' with the command 'aaa authorization exec default group xxxxx'. This then assumes your Radius server will send a Cisco AV Pair ('shell:priv-lvl=XX')to set the Privilege level of the user. You can still get to a higher privilege level with the 'enable' command, however another Radius login is sent if you do this with a username of '$enab15$' (for level 15).

My current Radius Template I use for IOS devices is this:

aaa group server radius Radius-Servers

server 10.10.10.10 auth-port 1812 acct-port 1813

server 10.10.20.10 auth-port 1812 acct-port 1813

ip radius source-interface Loopback0

!

aaa authentication login default group Radius-Servers local line

aaa authentication enable default group Radius-Servers enable

aaa authentication dot1x default group Radius-Servers

aaa authorization console

aaa authorization exec default group Radius-Servers if-authenticated

aaa authorization network default group Radius-Servers

aaa accounting dot1x default start-stop group Radius-Servers

aaa accounting exec default start-stop group Radius-Servers

aaa accounting network default start-stop group Radius-Servers

aaa accounting system default start-stop group Radius-Servers

!

radius-server host 10.10.10.10 auth-port 1812 acct-port 1813 key cisco

radius-server host 10.10.20.10 auth-port 1812 acct-port 1813 key cisco

!

I am using MS IAS for Radius and I have various policies defined that check for different attributes depending on the authentication type - i.e. Console/Terminal access, VPN, Wireless 802.1x, Wired 802.1x and WEB Proxy-Authentication.

HTH

Andy

Please rate useful posts.

Andy,

This is what I posted to the IOS, and I receive authorization failed. I only want to pass to radius on vty 0 4. I have also locked myself out and will reboot tonight.

aaa new-model

radius-server host 10.0.22.208 auth-port 1645 acct-port 1646 key cisco

ip radius source-interface Vlan40

aaa authentication login TRAuthList group radius local

You are probably going to have to post a bit more of the config....

After you have rebooted console or telnet in and set the exec-timeout to 0 so you don't get logged out automatically, you should then be able to debug what is going on by telnet'ing a 2nd time into the switch.

Are you trying this via telnet or the console? By default the console does not perform authorization automatically (you need to enter 'enable'). This can be overridden with the hidden global command 'aaa authorization console'. I am not sure this is your issue though?

HTH

Andy