topic Re: How to enable Command Authorization in ACS? in Network Access Control https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998034#M406909 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P> You need to apply these commands for authentication &amp; authorization on the router/switch and ACS server. </P><P></P><P>aaa new-model</P><P>aaa authentication login default group tacacs+ local</P><P>aaa authorization config-commands</P><P>aaa authorization exec default group tacacs+ if-authenticated</P><P>aaa authorization commands 0 default group tacacs+ local</P><P>aaa authorization commands 1 default group tacacs+ local</P><P>aaa authorization commands 15 default group tacacs+ local</P><P>aaa authorization network default group tacacs+</P><P></P><P>U can also exclude ur console from AAA --</P><P></P><P>line con 0</P><P> login authentication local_auth</P><P>exit</P><P></P><P>Plz rate it if helpful .....</P></BODY></HTML> Tue, 10 Jun 2008 06:18:04 GMT abhay_i386 2008-06-10T06:18:04Z How to enable Command Authorization in ACS? https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998032#M406907 <P>hi,</P><P> I have ACS 4.1 for Windows!!</P><P>I am testing Cisco6513 for command authorization for a user.</P><P> The problem is that the switch is authorizing the commands which i have denied in ACs for that particular user.</P><P>I am attaching the screen shots.</P><P>Can any one tell me what i am missing?Does i need to put some some commands in 6513 to enable command authorization in the ACS?</P><P>My Switch config for ACS is:</P><P></P><P>aaa new-model</P><P>aaa group server tacacs+ name1</P><P>server ACSserver1</P><P>!</P><P>aaa authentication login default group name1 local</P><P>aaa authentication enable default group name1 enable</P><P>aaa authorization exec default group name1 if-authenticated</P><P>ip http authentication aaa</P><P>tacacs-server host ACSserver1</P><P>no tacacs-server directed-request</P><P>tacacs-server key xxxxx</P><P></P><P></P><P> </P><P></P> Sun, 10 Mar 2019 22:53:25 GMT https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998032#M406907 rajeev.payal 2019-03-10T22:53:25Z Re: How to enable Command Authorization in ACS? https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998033#M406908 <HTML><HEAD></HEAD><BODY><P>You are missing these commands,</P><P></P><P></P><P>aaa authorization commands 1 default group tacacs+ if-authenticated</P><P> aaa authorization commands 15 default group tacacs+ if-authenticated</P><P> aaa authorization config-commands</P><P></P><P></P><P>Regards,</P><P>~JG</P><P></P><P>Do rate helpful posts</P></BODY></HTML> Thu, 05 Jun 2008 11:58:44 GMT https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998033#M406908 Jagdeep Gambhir 2008-06-05T11:58:44Z Re: How to enable Command Authorization in ACS? https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998034#M406909 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P> You need to apply these commands for authentication &amp; authorization on the router/switch and ACS server. </P><P></P><P>aaa new-model</P><P>aaa authentication login default group tacacs+ local</P><P>aaa authorization config-commands</P><P>aaa authorization exec default group tacacs+ if-authenticated</P><P>aaa authorization commands 0 default group tacacs+ local</P><P>aaa authorization commands 1 default group tacacs+ local</P><P>aaa authorization commands 15 default group tacacs+ local</P><P>aaa authorization network default group tacacs+</P><P></P><P>U can also exclude ur console from AAA --</P><P></P><P>line con 0</P><P> login authentication local_auth</P><P>exit</P><P></P><P>Plz rate it if helpful .....</P></BODY></HTML> Tue, 10 Jun 2008 06:18:04 GMT https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998034#M406909 abhay_i386 2008-06-10T06:18:04Z Re: How to enable Command Authorization in ACS? https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998035#M406910 <HTML><HEAD></HEAD><BODY><P>Thanks to both of you..Problem solved!!</P></BODY></HTML> Wed, 11 Jun 2008 13:42:05 GMT https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998035#M406910 rajeev.payal 2008-06-11T13:42:05Z Re: How to enable Command Authorization in ACS? https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998036#M406911 <HTML><HEAD></HEAD><BODY><P>I have been looking for the command to exclude the console port but haven't found it. Can someone point me in the right direction?</P></BODY></HTML> Wed, 11 Jun 2008 18:10:50 GMT https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998036#M406911 lundvall 2008-06-11T18:10:50Z Re: How to enable Command Authorization in ACS? https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998037#M406912 <HTML><HEAD></HEAD><BODY><P>For that you need to set up a method list,</P><P></P><P></P><P>Username test privilege 15 password test</P><P>aaa new-model</P><P>aaa authentication login vty_login group tacacs local</P><P>aaa authentication login console_login local</P><P>aaa authorization exec vty_login group tacacs local</P><P>tacacs-server host <IP address="" of="" the="" acs="" sever=""> key cisco</IP></P><P></P><P>line vty 0 4</P><P>login authentication vty_login</P><P></P><P>line con 0</P><P>login authentication console_login</P><P></P><P></P><P>Regards,</P><P>~JG</P><P>Do rate helpful posts</P></BODY></HTML> Wed, 11 Jun 2008 18:48:19 GMT https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998037#M406912 Jagdeep Gambhir 2008-06-11T18:48:19Z Re: How to enable Command Authorization in ACS? https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998038#M406913 <HTML><HEAD></HEAD><BODY><P>thank you very much.</P></BODY></HTML> Thu, 12 Jun 2008 16:18:46 GMT https://community.cisco.com/t5/network-access-control/how-to-enable-command-authorization-in-acs/m-p/998038#M406913 lundvall 2008-06-12T16:18:46Z