Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Enable mode with AAA & ACS

I'm trying to config a 12.0(5.1)XP 2900XL IOS switch to automatically go into enable mode once authenticated, without having to enter "enable." I'm running ACS3.1. Her is the AAA config:

aaa new-model

aaa authentication login default group tacacs+ local-case

aaa authentication login LOCAL local-case none

aaa authentication enable default group tacacs+ enable

aaa authorization exec default if-authenticated group tacacs+

aaa authorization commands 0 default local group tacacs+ if-authenticated

aaa authorization commands 15 default local group tacacs+ if-authenticated

aaa accounting update newinfo

aaa accounting exec default start-stop group tacacs+

aaa accounting exec LOCAL start-stop group tacacs+

aaa accounting commands 0 default start-stop group tacacs+

aaa accounting commands 0 LOCAL start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting commands 15 LOCAL start-stop group tacacs+

aaa accounting system default start-stop group tacacs+

9 REPLIES
New Member

Re: Enable mode with AAA & ACS

If you assign privilege level 15 to the user or group, EXEC authorization takes care of this with the service=shell, set-priv-lvl=15 Attribute Value Pair.

You have aaa authorization exec configured correctly, assign priv 15 and see if it works. If you do have it assigned and it is not working, let us know, there are some other issues that may be causing this....

New Member

Re: Enable mode with AAA & ACS

I set the Service=shell and Privlege Level=15 on both the users and group levels areas of the ACS, and neither did the trick.

New Member

Re: Enable mode with AAA & ACS

I forgot to mention that I'm using ACS for WIndows.

New Member

Re: Enable mode with AAA & ACS

Does it work on vty (telnet) sessions and not the console? If so, try:

aaa authorization console

New Member

Re: Enable mode with AAA & ACS

It doesn't work on vty connections. Before I added the ACS server, it was working on vty connections using local username and password authentication with the following AAA config.

hostname s1-carson

!

aaa new-model

aaa authentication password-prompt Password:

aaa authentication username-prompt Username:

aaa authentication login default local-case enable

aaa authorization exec default local none

aaa authorization commands 15 default local none

enable secret 5 ***** Text Removed *****

!

username ** removed ** psnet privilege 15 password 7 ** removed **

!

!

!

!

line con 0

transport input none

stopbits 1

line vty 0 4

length 25

line vty 5 15

!

Cisco Employee

Re: Enable mode with AAA & ACS

Try changing:

aaa authorization exec default if-authenticated group tacacs+

to:

aaa authorization exec default group tacacs+ none

I think the if-authenticated is being used instead of the TACACS server attributes cause you have it first. In fact, the TACACS server will never be used for authorization with your current setup because the "if-authenticated" will always be used first and will never fail (unless authentication fails first).

New Member

Re: Enable mode with AAA & ACS

Thanks that did the trick!!!

New Member

Re: Enable mode with AAA & ACS

Hello:

A while back you had asked for assistance regarding setting up TACAS to the router logins to skip over to enable mode. I am currently trying to get this to work myself. Would it be possbile for you to post your working configuration (minus passwords of course), on the Cisco site? Also, any comments regarding what you had to do on the CiscoSecure site would be useful as well.

Thank you in advance.

New Member

Re: Enable mode with AAA & ACS

This is part of EXEC authorization when the user logs in:

aaa new-model

aaa authentication login default group tacacs+ local

aaa authorization exec default group tacacs+ local

tac server key

username foo privilege 15 password bar

Assign the user or group privilege level 15 and away you go. You can use your local account if the connection to the tac+ server goes down or you receive an error for things like a key mismatch.

There are oodles of examples on cisco.com. Here is a good reference:

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Internetworking:Tacacs_plus&s=Implementation_and_Configuration

408
Views
0
Helpful
9
Replies