topic Re: TACACS+ Configuration Network Devices asking for Enable password in Network Access Control

TACACS+ Configuration Network Devices asking for Enable password

joseluis — Mon, 11 Mar 2019 08:48:57 GMT

Hi Cisco Community,

I'm new on configuring tacacs, hope you can help me.

I have a issue, every time I log in using my TACACS+ account it still ask me for the enable password

based on the config below, what is the command here that still asks me for the enable password? or should I delete the enable password itself to bypass that?

my goal is:

1. whenever I logged in my credentials using my tacacs+ account, i can proceed already to priv mode and the device should not ask for the enable password.

2. are all the config here are necessary? if no, can you help me identify what are the unnecessary commands to achieve goal 1?

CONFIG:

aaa new-model
aaa group server tacacs+ default
server 172.x.x.x
!
aaa group server tacacs+ ciscosecure
server 172.x.x.x.x
!
aaa authentication login default group tacacs+ line
aaa authentication login console line none
aaa authorization config-commands
aaa authorization commands 0 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
!
aaa session-id common

tacacs-server host 172.x.x.x
tacacs-server directed-request
tacacs-server key 7 030A0B090A1A2F481D1B
radius-server source-ports 1645-1646

Re: TACACS+ Configuration Network Devices asking for Enable password

balaji.bandi — Wed, 29 Aug 2018 06:40:20 GMT

Add below line.

aaa authorization exec default group tacacs+ local if-authenticated

“if-authenticated” keyword at the end of this line, if authenticated we will immediately be dropped into exec (enable) mode.

Make sure you do this using test device always with console access, if you lockout yourself you have console access to fix.

Test and Advise.

Re: TACACS+ Configuration Network Devices asking for Enable password

hslai — Sun, 02 Sep 2018 02:53:55 GMT

Also check out several T+ resources @ http://cs.co/ise-guides

The login user needs a default privilege set to its enable level for this to work, besides the configuration line provided.