topic Re: Does TACACS+ Authorisation work with console? in Network Access Control

Does TACACS+ Authorisation work with console?

rajesh1331 — Sun, 10 Mar 2019 23:14:09 GMT

Hi.

I havce configured routers fo ACS Login with 2 users with different Privilage level. When I log in through telnet it works fine with different privilage level, but when i log in through console the authorisation does not take place properly and i get all privilages for users with lesser privilages also.

All my authorisation is also done in ACS.

Re: Does TACACS+ Authorisation work with console?

Collin Clark — Mon, 15 Dec 2008 14:15:27 GMT

Yes in can work with console access, I have it working.

Hope that helps.

Re: Does TACACS+ Authorisation work with console?

Richard Burts — Mon, 15 Dec 2008 22:49:40 GMT

Rajesh

There is a reason that it is not working for you and a way to get it to work. It is not working for you because by default authorization does not process on the console connection. Cisco does this as a safety mechanism, because if you configure authorization and get it wrong you can lock yourself out of the router. If authorization does not process on the console then you have a way to recover without needing to blow away the config and recreate it.

If you want authorization to process on the console and you are willing to live with the risk then you can enable authorization on the console using this command:

aaa authorization console

HTH

Rick