AAA TACACS Authorization fail

skkshahbaz — Mon, 11 Mar 2019 05:49:54 GMT

AAA Tacacs authentication working fine

tacacs authorization not working

Tacacs server shell profile default privilege lvl 1 and mx pivilege lvl 15

allowed command (enable and config terminal)

on Authenticator (cisco 3725 version 12.4(7)

configuration

===========

aaa group server tacacs+ ACS_TACACS
server-private 192.168.1.10 key *****

aaa new-model
aaa group server tacacs+ ACS_TACACS
aaa authentication login VTY_ACCESS group ACS_TACACS local
aaa authentication enable default group ACS_TACACS enable line
aaa authorization commands 0 VTY_ACCESS group ACS_TACACS local
aaa authorization commands 1 VTY_ACCESS group ACS_TACACS local
aaa authorization commands 15 VTY_ACCESS group ACS_TACACS local

line vty 0 4
authorization commands 0 VTY_ACCESS
authorization commands 1 VTY_ACCESS
authorization commands 15 VTY_ACCESS
authorization exec VTY_ACCESS
accounting commands 0 VTY_ACCESS
accounting commands 1 VTY_ACCESS
accounting commands 15 VTY_ACCESS
login authentication VTY_ACCESS

Now when i telnet from supplicant to authenticator

authentication works fine

but when i enter enable to get access to privilege mode it says command authentication failed

Authenticator>enable
Command authorization failed.
^
% Invalid input detected at '^' marker.

can some one tell me if there is any issue on my device config?

or any other possible issue incase of authorization failure?

Thanks

What privilege level are you

nspasov — Mon, 22 Jun 2015 16:45:11 GMT

What privilege level are you returning from ACS for this user? Also, what is your overall goal? Perhas we can provide you with some suggestions.

Thank you for rating helpful posts!

topic AAA TACACS Authorization fail in Network Access Control

AAA TACACS Authorization fail

What privilege level are you