topic Re: How to deny enable command. in Network Access Control

How to deny enable command.

aspangenberg — Sun, 10 Mar 2019 22:28:45 GMT

On our current config we have this...

Aaa new-model

Aaa authentication login default group tacacs+ local

Aaa authorization config-commands

Aaa authorization exec default group tacacs+ local

Aaa authorization commands 15 default group tacacs+ if-authenticated

In tacacs we have each user in a group. Each group calls upon a command authorization set. In the command set we have denied enable, but we are still able to run enable. The other commands that we test work fine. Any suggestions? Are we able to deny enable at all?

Thank You,

Andrew

Re: How to deny enable command.

somishra — Fri, 26 Oct 2007 17:25:47 GMT

Hi Andrew,

Add the following commands on the device:

aaa authorization commands 0 default group tacacs+ if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

Rgds

somishra

Re: How to deny enable command.

aspangenberg — Fri, 26 Oct 2007 17:41:10 GMT

Thank You Very Much! I've been pulling my hair out over that for too long. lol

Have a good one.

-Andrew