topic Re: aaa configuration with Radius in Network Access Control

aaa configuration with Radius

Raghavendra.P — Fri, 21 Feb 2020 18:46:52 GMT

Hi All,

I have a problem in AAA configuration on switch Cisco 3560 the IOS is C3560-ADVIPSERVICESK9-M, Version 12.2(25)SE.

The AAA configuration is working fine with Radius but after Authenticating the switch is login and entering in enable mode instead of entering in privilege mode.

When providing the Enable it asking for enable password then entering to privilege mode.

Can any help me to configure which should not ask for enable password which should directly enter in privilege mode

Presently AAA configuration on switch is as below.

aaa new-model
aaa authentication login default group radius local
aaa authentication login NOAUTH none
aaa accounting exec default start-stop group radius
aaa accounting connection default start-stop group radius
!
aaa session-id common

radius-server host X.X.2.100 auth-port 1645 acct-port 1646 key 7 ABCD
radius-server source-ports 1645-1646
radius-server timeout 2
radius-server key 7 ABCD

Re: aaa configuration with Radius

johnd2310 — Wed, 28 Feb 2018 15:18:49 GMT

What is the configuration on the Radius server?

Thanks

John

Re: aaa configuration with Radius

Philip D'Ath — Wed, 28 Feb 2018 15:38:12 GMT

Try adding something like:

aaa authorization exec default group radius

Re: aaa configuration with Radius

Mohammed al Baqari — Wed, 28 Feb 2018 17:33:43 GMT

line vty 0 15
privilege level 15

Or configure aaa authentication login default group tacacs , aaa
authentication enable default group tacacs along with your exec
authorization command. Then in radius server configure Shell(Exec) level to
15

Re: aaa configuration with Radius

Jatin Katyal — Wed, 28 Feb 2018 19:33:33 GMT

In addition to what Philip suggested, ensure that you are pushing attribute -

Service-Type = Administrative in the authorization profile. Please refer the attached screen shot.