Access is still denied. The restricted group works.. (unable to get into enable mode), but the full access group can get into enable mode but not conf t

Hi,

For the full group you just need to do this:

Under shared profile component > shell command authorization set > select the radio button permit.

If that doesn't works please send the screen shots of full access command set.

HTH

JK

Plz rate hopeful posts.

Issues seems to be with command authorization. It would have been better if running config is included in the original post.

What message do you see on acs failed attempt?

Any ways , please apply command set (that allows all command) on user level instead of group level.

or

Check the failed attempts and see which group you are a part of, then apply command set to that group.

Good luck!

Regards,

~JG

Do rate helpful posts

Access is still denied. The restricted group works.. (unable to get into enable mode), but the full access group can get into enable mode but not conf t

Where in ACS can I see failed authorization messages?

Reports and activities -->failed attempts

Where in ACS can I see failed authorization messages?

In the log my username shows up as "enable_15" ?? and says user unknown?

What will this command do?, Does it make me use my own individual enable password?

This command is needed to make command authorization work.

Yes, you can set your own enable password.

Regards,

~JG

Same issue was reported sometime back aswell.

Make sure you have enable authentication ,

aaa authentication ssh console TACACS LOCAL

aaa authentication telnet console TACACS LOCAL

aaa authentication enable console TACACS LOCAL

aaa authorization command TACACS LOCAL

Incase it does not work pls get aaa config

Regards,

~JG

Do rate helpful posts

yes, if you have separate enable password configured on the ACS, it will let you use that. But i would also suggest you to keep your current session open and try from a duplicate session...just a back door entry.

HTH

JK

Plz rate helpful posts-