cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1634
Views
10
Helpful
6
Replies

Enabling Cisco Switches authentication against ACS

jorge.s
Level 1
Level 1

Hi,

could you post some example of how to configure a switch to have the logins authenticated by an ACS or in case of problems, local user?

Jorge

6 Replies 6

mchiaravalle_2
Level 1
Level 1

I've been using this:

aaa new-model

aaa authentication login default group tacacs+ local

aaa authorization exec default group tacacs+ local

aaa authorization network default group tacacs+ local

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

tacacs-server host 192.168.12.200 key ********

Works fine for me and it gives you the accounting which logs all your device config changes. I'm running ACS v4.0

But is there a way to configure the level of access, on the CiscoACS Server? how is it then passed to the Switch? for example a user with access level 15 and another one with 10 and another one with just 5?

Second question, here you are mentioning that all commands 15 will be sent to the ACS Server, can we send it from all the levels? or we need to mention one by one?

Thanks a lot,

Jorge

pemock
Level 1
Level 1

Here's what AAA/ACS config looks like:

aaa new-model

aaa authentication login default group tacacs+ enable none

aaa authentication enable default group tacacs+ enable none

aaa authorization exec default if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated none

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

tacacs-server host x.x.x.x key mykey

tacacs-server host x.x.x.x key mykey

This one requires you to enter an enable password to reach level 15 and doesn't use any local accounts as a backup since I don't have any.

But is there a way to configure the level of access, on the CiscoACS Server? how is it then passed to the Switch? for example a user with access level 15 and another one with 10 and another one with just 5?

Second question, here you are mentioning that all commands 15 will be sent to the ACS Server, can we send it from all the levels? or we need to mention one by one?

Thanks a lot,

Jorge

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: