AAA / ACS / Enable Mode

[satishcp]

Guys,

I?ve configured AAA on network devices for access authentication against ACS (3.2 on Windows). ACS is configured to authenticate users against Windows AD accounts. ACS is configured properly and I?m able to login using AD accounts onto network devices. However I have a basic question here:

The privilege level set to users / user groups on ACS is level 15 for all AAA clients. When user login using SSH / Telnet connection, by default he is placed in privilege level 1. The user has to give enable command and type in enable password to geton to enable mode. Is this normal way of working or am I missing something here.

How do I place the users in privilege mode by default?

Appreciate help,

-Satishcp

[cco1]

Hi,

same problem here with FWSM. I just want to log in to FWSM via ssh and get into enabled mode instantly without having to type in "enable".

Regards,

Marco

[Richard Burts]

Satishcp

I believe that the functionality that you want needs you to configure aaa authorization as well as aaa authentication.

HTH

Rick

[Collin Clark]

cco1-

You can't on the FWSM/PIX/ASA, it requires you to enter a password twice for security purposes.

[andrew.burns]

Hi,

If it's just a router then you should be able to fix this in the ACS server by modifying the Privilege Level attribute - change it from the default of 1 to 15. (Don't confuse this with the Max Privilege setting in Enable Options).

Not totally sure about version 3.2 but this works in 3.3 and later.

HTH

Andrew.

[pvanvuuren]

Hi Satishcp

There are two parts of making sure your users getin to enable "priv 15" mode onto a router/switch.

1. First , make sure the user is in a group that has Shell access and priv level 15 enabled. The router/switch is going to look for this for "authorisation".

2. Secondly, you need this line of aaa config in you router/switch: aaa authorization exec default group tacacs+ if-authenticated

that should do it. It the "if-authenticated" part that makes a difference. and the authorisation of course.

Let us know.

cheers

P

[satishcp]

This is great guys, I never thought it would be so easy to get answers. Thanks, it worked the same way I wanted it to be.

Thanks again,

Satishcp