topic config command authorization not enabled in Network Access Control

config command authorization not enabled

nikalleyne — Mon, 11 Mar 2019 00:32:14 GMT

Can someone tell me why I'm getting this message. I'm beginning to think this has something to do with my device failing authorization.

Show version

Catalyst 4000 L3 Switch Software (cat4000-I9S-M), Version 12.1(19)EW1, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

Re: config command authorization not enabled

Panos Kampanakis — Mon, 01 Nov 2010 18:29:42 GMT

Are you really running 12.1?

When are you receiving the message?

Do you have aaa authorization enabled? Can you post the "sh run | i aaa" output?

Re: config command authorization not enabled

nikalleyne — Tue, 02 Nov 2010 00:43:19 GMT

Yep! I'm really running 12.1!

I'm receiving the message once i include "aaa authorization exec default group radius local if-authenticated" in the config.

Login is successful, however authorization does not allow me to go directly into enable mode. If I take the aaa authorization line out I can login to user mode and then use the enable password to move forward but that is not what I wish to achieve.

sh run | i aaa

aaa new-model
aaa authentication attempts login 5
aaa authentication banner ^C
aaa authentication fail-message ^C
aaa authentication login My-RADIUS group radius local
aaa accounting exec My-RADIUS start-stop group radius
aaa session-id common

Is there somewhere specific I was suppose to configure the aaa authorization enabled, because I'm not seeing it.

Let me know what other thoughts you may have.

Thanks

Nik

Re: config command authorization not enabled

iilyinas — Tue, 02 Nov 2010 12:23:13 GMT

Hi, Nik,

The aaa authorization exec radius if-authenticated command configures the network access server to contact the RADIUS server to determine if users are permitted to start an EXEC shell when they login.

Try to use aaa authorization config-commands and aaa authorization commands 15.

Cheers, Iron

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: config command authorization not enabled

nikalleyne — Tue, 02 Nov 2010 14:23:31 GMT

Iron,

Thanks for your reply. However, I do wish for the users to be validated against RADIUS before they can use enable commands. When I entered your suggestion I can still authenticate without any problems. However, I still default to user mode. I would like it to default to priviledge mode once a user successfully logs in.

Your thoughts!

Re: config command authorization not enabled

Richard Burts — Tue, 02 Nov 2010 22:56:02 GMT

Nik

Part of what you posted seems to show that you are using non-default methods (My-RADIUS) for authentication and for accounting. It is not clear to me whether a non-default method is also desired for the authorization. Perhaps it would help to clarify if you would post the parts of the config that are for aaa and the parts of the config for the console and vty lines. (complete config might be even better - but these parts would get us started)

HTH

Rick