aaa authorization

elite2010 — Fri, 21 Feb 2020 19:12:00 GMT

Hi,

aaa authorization config-commands

aaa authorization exec default group tacacs+ local

aaa authorization commands 0 default group tacacs+ local

aaa authorization commands 10 default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local

Am I missing any commands from the above. What if tacacs (ise failed ), All the commands will be authorized ? .

I want users will be able to login and enter commands in case tacacs failed ?

Thanks

Re: aaa authorization

Anurag Sharma — Wed, 20 Nov 2019 10:34:15 GMT

Assuming you already have the aaa authentication commands in place, I have a small suggestion:

aaa authorization commands 10 default group tacacs+ local

Change it to:

aaa authorization commands 1 default group tacacs+ local

Once you configure (one or more) privilege level 15 user, locally on the switch, it will work fine in case of TACACS server going unresponsive.