ACS 5.2 x Nexus 9k TACACS authentication (permission problem)

[everton.sales]

Hi guys,

I have a Cisco ACS configured with tacacs authentication for all network devices.

The TACACS authentication is working fine for all catalyst switches (authentication and permissions). But for my nexus 9k, the permissions aren’t working!

I can authenticate normally with any user, but when I authenticate users with restricted access that are not allowed to type CONF T or Delete commands for example, the nexus just ignores the rules configured on my ACS and let the users type any command.

I have this problem only with Nexus 9k!

Does anyone know what is causing this ?

Thank you

[Arne Bier]

can you share your ACS TACACS Command Set and Shell Profile that you return to the Nexus for the situation you described?

On the Nexus you need to specify the authorization too

aaa authentication login default group tacacs-login
aaa authentication login console group tacacs-login
aaa authorization config-commands default group tacacs-login local
aaa authorization commands default group tacacs-login local
aaa accounting default group tacacs-login

[everton.sales]

Hi Arne,

Thank you for your reply.

Here's the config:

tacacs-server key 7 "MYKEY"

ip tacacs source-interface Vlan1

tacacs-server host 10.21.18.10 key 7 "MYKEY"

aaa group server radius radius

aaa group server tacacs+ ACS

    server 10.21.18.10

aaa authentication login default group ACS

aaa authentication login console group ACS

aaa accounting default group ACS

aaa authentication login error-enable

aaa authentication login default group ACS

aaa authentication login console group ACS

aaa authorization ssh-publickey default local

aaa authorization ssh-certificate default local

aaa authorization config-commands default local

aaa authorization commands default local

aaa authorization config-commands console local

aaa authorization commands console local

aaa accounting default group ACS

aaa user default-role

aaa authentication login default fallback error local

aaa authentication login console fallback error local

no aaa authentication login invalid-username-log

aaa authentication login error-enable

no aaa authentication login mschap enable

no aaa authentication login mschapv2 enable

no aaa authentication login chap enable

no aaa authentication login ascii-authentication

I don't have access to the ACS right now, I'll post the ACS config later.

Thank you.

[Francesco Molino]

Hi

Can you send us the config you're using on nexus 9k?
Does the user you're using is also configured locally on the switch with same username?
What are the logs you get on acs when trying to do conf t command?

[everton.sales]

Hi Francesco,

Thank you for your reply.

I don't have this user locally configured on my nexus 9k. 

Here's the N9k config:

tacacs-server key 7 "MYKEY"

ip tacacs source-interface Vlan1

tacacs-server host 10.21.18.10 key 7 "MYKEY"

aaa group server radius radius

aaa group server tacacs+ ACS

    server 10.21.18.10

aaa authentication login default group ACS

aaa authentication login console group ACS

aaa accounting default group ACS

aaa authentication login error-enable 

aaa authentication login default group ACS

aaa authentication login console group ACS

aaa authorization ssh-publickey default local

aaa authorization ssh-certificate default local

aaa authorization config-commands default local

aaa authorization commands default local

aaa authorization config-commands console local

aaa authorization commands console local

aaa accounting default group ACS

aaa user default-role

aaa authentication login default fallback error local

aaa authentication login console fallback error local

no aaa authentication login invalid-username-log

aaa authentication login error-enable

no aaa authentication login mschap enable

no aaa authentication login mschapv2 enable

no aaa authentication login chap enable

no aaa authentication login ascii-authentication

I don't have access to the ACS right now, I'll post the configs and logs later.

Thank you.

[Francesco Molino]

Hi

all your authorization configs point to local, or I missread from my iphone and I'm sorry.
It should be something like:
aaa authorization commands default group ACS local
aaa authorization config-commands default group demoTG local

For the console that's ok as N9K doesn't support TACACS+ authorization when connected through Console.