topic Re: AAA authentication and Authorization in Network Access Control

AAA authentication and Authorization

salemmahara — Fri, 21 Feb 2020 19:00:23 GMT

Hello eveyone

Here is a simple configuration of TACACS+ . Authentication is ok, enable password is checked, but after entering to Privilege mode (Router#) there is a problem with authorization. logged in user can perform allllll commands 🙂 :

aaa new-model

aaa authentication login TEST group tacacs+

aaa authorization enable default group tacacs+

aaa authorization exec TEST group tacacs+

aaa authorization network TEST group tacacs+

line vty 0 4

authorization exec TEST

I tried to deny all commands on TACACS+ server but ...

May I have your ideas please?

Re: AAA authentication and Authorization

Francesco Molino — Sun, 08 Jul 2018 11:59:19 GMT

You're missing some aaa statements to ask the device to check all commands typed in by a user against tacacs:

aaa authorization config-commands

aaa authorization commands 1 TEST group default local if-authenticated

aaa authorization commands 0 TEST group default local if-authenticated

aaa authorization commands 15 TEST group default local if-authenticated

line vty 0 15

authorization commands 1 TEST

authorization commands 0 TEST

authorization commands 15 TEST

Here a complete doc: https://communities.cisco.com/servlet/JiveServlet/downloadBody/68194-102-1-125121/How-To_TACACS_for_IOS.pdf

Re: AAA authentication and Authorization

salemmahara — Tue, 10 Jul 2018 05:24:46 GMT

Hi Ferancesco

Thanks for replying.

aaa authorization config-commands was forgotten

Re: AAA authentication and Authorization

Francesco Molino — Wed, 11 Jul 2018 00:53:56 GMT

You're welcome