Hi,
This is how its working now as per the config:
-Your console port is authenticated using enable password
-For your telnet sessions:
You are getting authenticated via tacacs+ server, if its unvailable then it falls back to local database. But your enable authentication falls back to the line password.
Now if you want to authenticate/authorize and want to get accounting records using tacacs server and then if its unavailable fall back to local database for login and for enable authen, fall back to enable password, then this is what you might want to do:
aaa new-model
aaa authentication login default group tacacs+ local
no aaa authentication login no_tacacs enable <--Remove this
no aaa authentication enable default group tacacs+ line<--Remove this
aaa authentication enable default group tacacs+ enable <---Add this
aaa authorization exec default group tacacs+ local
aaa authorization commands 0 default group tacacs+ local <--Add this to cover level 0 commands
aaa authorization commands 1 default group tacacs+ local <--Add this to cover level 1 commands
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+ <-For level 0 accounting
aaa accounting commands 1 default start-stop group tacacs+ <--For level 1 acocunting
aaa accounting commands 15 default start-stop group tacacs+
aaa authorization console --> This is required if you want to authorize console port.
also, please don't forget to remove the following line from console port:
line con 0
no login authentication no_tacacs
NOTE: Please don't forget to create atleast one admin account with priv level 15 before you apply the above commands:
username admin privilege 15 password cisco
I hope this help ! Thanks,
Mynul
