topic Configuring AAA with backup line and enable in Network Access Control https://community.cisco.com/t5/network-access-control/configuring-aaa-with-backup-line-and-enable/m-p/142307#M436055 <P>I have AAA pointing to ACS 3.1 and works fine. In case it's ever down, I want to use the line and enable passwords as a backup. I think I have it working properly but if someone else is using this method, can you confirm I have this right:</P><P></P><P>aaa new-model</P><P>aaa authentication login default group tacacs+ line</P><P>aaa authentication enable default group tacacs+ enable</P><P>aaa authorization exec default group tacacs+ if-authenticated</P><P>aaa accounting exec default start-stop group tacacs+</P><P>aaa accounting commands 15 default start-stop group tacacs+</P><P></P><P>The authorization with "if-authenticated" is the only way I can figure out how to allow exec privleges if I have to use the line and enable passwords. Otherwise it gives me an authorization failed error after trying to authenticate.</P> Sun, 10 Mar 2019 14:26:29 GMT dkorell 2019-03-10T14:26:29Z Configuring AAA with backup line and enable https://community.cisco.com/t5/network-access-control/configuring-aaa-with-backup-line-and-enable/m-p/142307#M436055 <P>I have AAA pointing to ACS 3.1 and works fine. In case it's ever down, I want to use the line and enable passwords as a backup. I think I have it working properly but if someone else is using this method, can you confirm I have this right:</P><P></P><P>aaa new-model</P><P>aaa authentication login default group tacacs+ line</P><P>aaa authentication enable default group tacacs+ enable</P><P>aaa authorization exec default group tacacs+ if-authenticated</P><P>aaa accounting exec default start-stop group tacacs+</P><P>aaa accounting commands 15 default start-stop group tacacs+</P><P></P><P>The authorization with "if-authenticated" is the only way I can figure out how to allow exec privleges if I have to use the line and enable passwords. Otherwise it gives me an authorization failed error after trying to authenticate.</P> Sun, 10 Mar 2019 14:26:29 GMT https://community.cisco.com/t5/network-access-control/configuring-aaa-with-backup-line-and-enable/m-p/142307#M436055 dkorell 2019-03-10T14:26:29Z Re: Configuring AAA with backup line and enable https://community.cisco.com/t5/network-access-control/configuring-aaa-with-backup-line-and-enable/m-p/142308#M436056 <HTML><HEAD></HEAD><BODY><P>This looks fine. Instead of "if-authenticated" you could use "none" so that there'll be no authorization done if the TACACS server is not available, either one will work for you.</P></BODY></HTML> Wed, 13 Aug 2003 04:20:49 GMT https://community.cisco.com/t5/network-access-control/configuring-aaa-with-backup-line-and-enable/m-p/142308#M436056 gfullage 2003-08-13T04:20:49Z Re: Configuring AAA with backup line and enable https://community.cisco.com/t5/network-access-control/configuring-aaa-with-backup-line-and-enable/m-p/142309#M436057 <HTML><HEAD></HEAD><BODY><P>That will work. Thanks for the response.</P></BODY></HTML> Wed, 13 Aug 2003 16:55:48 GMT https://community.cisco.com/t5/network-access-control/configuring-aaa-with-backup-line-and-enable/m-p/142309#M436057 dkorell 2003-08-13T16:55:48Z