Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Cisco Support Community site will be in read only mode on Dec14, 2017 from 12:01am PST to 11:30am for standard maintenance. Sorry for the inconvenience.

aaa authorization (device doesn't always go into enable mode)

When I log into the 4500 switch with my domain account, I get priv 1 only and have to “enable” with the local enable password to get to priv 15.  How do I set this up to get directly to enable? The ACS 5.1 is setup with a authorization/shell profile for Priv 15, no problems there.

2821-RTR2#show run | incl aaa
aaa new-model
aaa authentication login default group tacacs+ local enable
aaa authentication login CONSOLE local-case line
aaa authorization exec default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common


4500 that drops into enable mode

4500-SW1#show run | incl aaa
aaa new-model
aaa authentication login default group tacacs+ local enable
aaa authentication login CONSOLE local-case line
aaa authorization exec default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common

1 REPLY
Cisco Employee

Re: aaa authorization (device doesn't always go into enable mode

On the non-working device enable:

debug aaa authen

debug aaa author

debug tacacs

and post the results.


Also, on ACS 5.1 review the details for the authen/author on both the working and non-working devices and see if the desired shell profile is picked for the non-working device.

262
Views
0
Helpful
1
Replies
CreatePlease to create content