topic Re: aaa authorization interpretation in Network Access Control

aaa authorization interpretation

mactej6228 — Fri, 21 Feb 2020 18:27:34 GMT

Hi..

Is this a correct interpretation on aaa authorization?

If I want to authorize certain commands or a certain privilege I use the following example

aaa authorization command 7 group tacacs

no aaa authorization config-commands

if you want to authorize all commands you would use the following:

aaa authorization config-commands

Re:aaa authorization interpretation

Tariq Bader — Sat, 28 Jul 2012 15:47:56 GMT

aaa authorization config-commands is for enabling the authorization for the configuration commands as it is disabled by default

Without this you will only authorize the exec commands and the config ones will not get checked against the AAA server for authorization

Tariq Bader

Re: aaa authorization interpretation

mactej6228 — Mon, 30 Jul 2012 01:07:52 GMT

Thanks Tariq, so if i issue the command:

aaa authorization commands 15 group tacacs

no aaa authorization config-commands

What commands are authorized? i'm quite confuse here because when issue the command "configure terminal" i get a "Command Authorization Failed" error will instead i'm in level 15, which is the highest level in which in my own understanding its the administrative level meaning I have a full access and why it's not..

Thanks in advance for all replies...

Re: aaa authorization interpretation

Tariq Bader — Tue, 31 Jul 2012 07:34:18 GMT

will authorize all the commands except the configuration commands that we type in the configuration mode:

router(config)#

configure terminal command is a exec level command and still needs to be permitted in the command set on AAA server.

Even if you are runnning level 15 access and you turn on command authorizarion using a TACACS AAA server on that level 15, all the commands you enter will be checked at the server to see if they authorized or not.

Tariq