Hi there, could you possibly explain what each command means ?

aaa new-model (starts your aaa model congiguration)

aaa authentication login vtymethod group tacacs+ local line (tells your router that when someone tries to login via a vty line (telnet, ssh) to first look to tacacs, then to a local group. So if the tacacs is unreachable for someone, you can authenticate as a local user)

aaa authentication login conmethod group tacacs+ local line (same thing for console)

aaa authentication enable default group tacacs+ enable (this line says, if someone authenticates via tacacs, send them straight to the priv exec mode. This is optional, but takes the hassle out of typing enable all the time)

aaa authorization config-commands (gives authorization to the users that successfully authenticate)

aaa authorization exec default group tacacs+ local (authorizes the above command sending tacacs users straight to priv mode)

aaa authorization commands 15 default group tacacs+ local (gives authenticated users authorization to use level 15 commands)

aaa accounting exec default start-stop group tacacs+ (for logging on tacacs)

aaa accounting commands 15 default start-stop group tacacs+ (for logging on tacacs)

tacacs-server host 10.0.0.x (tells router where the tacacs server is)

tacacs-server host 10.0.0.x (alternate tacacs server, optional)

tacacs-server key type_key_here (tacacs key so the router is authorized to use tacacs)

Obviously, depending on what you are doing, some variation can go into these commands. There are tons of aaa commands that can do about anything you was. The example I gave is with one tacacs group, all having priv access. But there are commands for multiple groups with different access and much tweaking. Good luck!

HTH

Justin

anything you WANT, not was

hi there, where do you control access to what the users can do, would this be on the acs server? can you do it also localy on the router by priveldge levels ?

Hi Carl,

If it is a AAA user, the privelege levels must be set thru the AAA interface, either by individual or group settings. If you are using local users, you can do this when you create the user:

router(config)#username (name) privilege (0-15) secret (secret_password)

When you set the privilege level, this will give the user access to the commands that correspond to that priv level.

hth,

Justin

Hi there

Can anyone tell me which screens I need to go in on the acs server to create the priviledge levels for each user?

thanks

 What of “ authorisation exec default local” 

“authorisation exec vtymethod group tacacs + local” and “authorisation commands 15 vtymethod group tacacs + local” thanks