topic Re: Getting starting with AAA in Network Access Control

Getting starting with AAA

umamon — Sun, 10 Mar 2019 22:44:58 GMT

Hi, I justed installed ACS 4.1 for Windows, I've added a user account and a router, my router can communicate with the ACS server, I can authenticate to the router, but my authentication will not take me into enable (or priviledge) mode. It takes me right to the user mode. From the server I tried granting priv 15 to my user group and also to me as a user still doesn't work. I have the basic configuration on the router

aaa new-model

aaa authentication login susd group tacacs+ local

tacacs-server host 10.x.x.x

tacacs-server directed-request

tacacs-server key xxxx

Can someone help a rookie out.

Re: Getting starting with AAA

Collin Clark — Thu, 27 Mar 2008 18:51:20 GMT

Try this:

ROUTER#config t

Enter configuration commands, one per line. End with CNTL/Z.

ROUTER(config)#line vty 0 4

ROUTER(config-line)#privilege level 15

ROUTER(config-line)#end

ROUTER#

HTH

Re: Getting starting with AAA

umamon — Thu, 27 Mar 2008 20:14:17 GMT

Hi HTH,

Thanks that worked!

Re: Getting starting with AAA

john.dowson — Sat, 05 Apr 2008 14:20:56 GMT

You can also achieve this using TACACS authorization. Enter the following command in global configuration mode:

aaa authorization exec default group tacacs+ local

This will enable the router to put you into your assigned privileged mode as configured on the ACS.

Re: Getting starting with AAA

umamon — Thu, 10 Apr 2008 16:01:08 GMT

I think this is actually the way I wanna go, so I can take advantage of aaa logging.

If I use this authorization command should I remove the privilege login from my VTY lines?

Re: Getting starting with AAA

john.dowson — Thu, 10 Apr 2008 21:26:03 GMT

Yes, you don't need the privilege level set on the VTY lines when using the authorization method.

John

Re: Getting starting with AAA

umamon — Thu, 10 Apr 2008 21:57:46 GMT

Thanks John,

That gave me exactly what i was looking for. I also had to place the authorization command on the line.

Re: Getting starting with AAA

john.dowson — Fri, 11 Apr 2008 14:09:04 GMT

Ah I guess you're using a named authorization method rather than the default one which is why it need applying to the VTY lines. The default method would apply to all lines where not already configured.

Re: Getting starting with AAA

umamon — Fri, 11 Apr 2008 15:19:03 GMT

John,

Do you think that the default method is the better way to go? I guess it would since I don't have to configure the lines.

Re: Getting starting with AAA

Jagdeep Gambhir — Fri, 11 Apr 2008 20:10:15 GMT

Default is a good option to use if you are not using any method-list.

Default key word cover all interfaces accept serial.

Regards,

~JG

Re: Getting starting with AAA

umamon — Sat, 12 Apr 2008 04:49:39 GMT

Thanks John, You've been a big help.