topic Re: AAA / ACS / Enable Mode in Network Access Control

AAA / ACS / Enable Mode

satishcp — Sun, 10 Mar 2019 21:51:33 GMT

Guys,

I?ve configured AAA on network devices for access authentication against ACS (3.2 on Windows). ACS is configured to authenticate users against Windows AD accounts. ACS is configured properly and I?m able to login using AD accounts onto network devices. However I have a basic question here:

The privilege level set to users / user groups on ACS is level 15 for all AAA clients. When user login using SSH / Telnet connection, by default he is placed in privilege level 1. The user has to give enable command and type in enable password to geton to enable mode. Is this normal way of working or am I missing something here.

How do I place the users in privilege mode by default?

Appreciate help,

-Satishcp

Re: AAA / ACS / Enable Mode

cco1 — Wed, 29 Nov 2006 14:26:28 GMT

Hi,

same problem here with FWSM. I just want to log in to FWSM via ssh and get into enabled mode instantly without having to type in "enable".

Regards,

Marco

Re: AAA / ACS / Enable Mode

Richard Burts — Wed, 29 Nov 2006 15:22:26 GMT

Satishcp

I believe that the functionality that you want needs you to configure aaa authorization as well as aaa authentication.

HTH

Rick

Re: AAA / ACS / Enable Mode

andrew.burns — Wed, 29 Nov 2006 16:32:58 GMT

Hi,

If it's just a router then you should be able to fix this in the ACS server by modifying the Privilege Level attribute - change it from the default of 1 to 15. (Don't confuse this with the Max Privilege setting in Enable Options).

Not totally sure about version 3.2 but this works in 3.3 and later.

HTH

Andrew.

Re: AAA / ACS / Enable Mode

pvanvuuren — Wed, 29 Nov 2006 19:00:52 GMT

Hi Satishcp

There are two parts of making sure your users getin to enable "priv 15" mode onto a router/switch.

1. First , make sure the user is in a group that has Shell access and priv level 15 enabled. The router/switch is going to look for this for "authorisation".

2. Secondly, you need this line of aaa config in you router/switch: aaa authorization exec default group tacacs+ if-authenticated

that should do it. It the "if-authenticated" part that makes a difference. and the authorisation of course.

Let us know.

cheers

Re: AAA / ACS / Enable Mode

satishcp — Fri, 01 Dec 2006 06:01:45 GMT

This is great guys, I never thought it would be so easy to get answers. Thanks, it worked the same way I wanted it to be.

Thanks again,

Satishcp

Re: AAA / ACS / Enable Mode

Collin Clark — Fri, 01 Dec 2006 13:19:31 GMT

cco1-

You can't on the FWSM/PIX/ASA, it requires you to enter a password twice for security purposes.