topic AAA authentication problem in Network Access Control

AAA authentication problem

ms4561 — Sun, 10 Mar 2019 21:52:36 GMT

I've setup my AAA config as follows "aaa authentication login default group tacacs+ enable". When I test config with SSH (ACS turned off)to the router I cannot login using the enable password. The same does not work when trying to connect with Con0. How can I correct this problem. Forum help is much appreciated, thanks all.

Re: AAA authentication problem

m.sir — Wed, 13 Dec 2006 07:19:47 GMT

You have authorization only with tacacs+, can you try following command

aaa authorization exec default group tacacs+ none

Re: AAA authentication problem

Richard Burts — Wed, 13 Dec 2006 18:03:53 GMT

I agree that the configuration of aaa authentication login looks ok (I would probably use line as the alternative method instead of enable - but it should work with either) and that the issue is the configuration of authorization:

aaa authorization exec default group tacacs+

this provides no alternative method. And I suspect that if you look carefully at the error message when you attempt to login without TACACS the error is actually about authorization rather than about authentication. The suggestion of:

aaa authorization exec default group tacacs+ none

should be ok. I have used this way with success:

aaa authorization exec default group tacacs+ if-authenticated

HTH

Rick