topic Setting a single global enable password in Network Access Control

Setting a single global enable password

aylmer — Sun, 10 Mar 2019 20:46:15 GMT

Is it possible to set a single enable password for all clients that authenticate through the ACS.

Instead of setting an enable password on a per user basis I would like to set it in a single global place once that will then be used by all clients added in the future.

Re: Setting a single global enable password

vimal1980 — Wed, 25 Aug 2004 04:10:36 GMT

Yes. It is possible.

Rgds

Vimal

Re: Setting a single global enable password

aylmer — Wed, 25 Aug 2004 06:10:43 GMT

Could you please tell me where within the ACS a global enable password can be set for all devices.

From what I have seen the only way is to set the enable password on a per user basis.

Re: Setting a single global enable password

will.shaw — Wed, 25 Aug 2004 10:17:02 GMT

Having one single enable password does raise some security issues. However, if this is the way you wish to proceed I would recommend setting the enable password on each device instead of on the ACS (what if the ACS goes down etc...).

Then you can use the command

aaa authentication enable default group tacacs+ enable

This will tell the device to first try for a tacacs+ enable password then use the local one if that fails.

You can of course remove the 'group tacacs+' statement and use only the enable password from the device.

To centrally manage the enable password, you could use something such as Kiwi Cat Tools to automate the distribution.