topic Re: AAA Authorization EXEC Default in Network Access Control

AAA Authorization EXEC Default

karenmelkonyanstu — Tue, 18 Apr 2023 13:34:03 GMT

Hello,

Is my understand correct that second command means that all the time when I log in on the device via SSH - it will immediately place me into Privilege\Enable mode without asking Enable password?
Would it be the same if I log in via Console?
1)aaa authentication login default group TACACS-GROUP local
2)aaa authorization exec default group TACACS-GROUP if-authenticated

Re: AAA Authorization EXEC Default

MHM Cisco World — Tue, 18 Apr 2023 13:44:58 GMT

I think NO
you need aaa authentication enable default group .....LOCAL

the
aaa authorization exec default group TACACS-GROUP if-authenticated <<- make you allow to enter enable command
then the SW/R ask for password which you need to config local or via AAA.

Re: AAA Authorization EXEC Default

Ambuj M — Tue, 18 Apr 2023 13:57:16 GMT

"Is my understand correct that second command means that all the time when I log in on the device via SSH - it will immediately place me into Privilege\Enable mode without asking Enable password?" see below.

https://community.cisco.com/t5/network-access-control/if-authenticated/td-p/1248124

"Would it be the same if I log in via Console? "

provided you configured console line login authentication default

Re: AAA Authorization EXEC Default

Christopher Bell — Tue, 18 Apr 2023 14:15:09 GMT

Correct. If you are using a TACACS server, you can use your auth profile in the policy set to either restrict commands or grant priv 15.

Re: AAA Authorization EXEC Default

karenmelkonyanstu — Wed, 19 Apr 2023 15:58:58 GMT

Thanks Everyone for your time Guys.

Thanks MHM - my second question was weather switch\router will require me to enter TACACS Credentials if I log in via console - and I found answer which is Yes.

Thanks.

Re: AAA Authorization EXEC Default

karenmelkonyanstu — Wed, 19 Apr 2023 16:01:27 GMT

Hi - Thanks for the response.
There is no need for any additional command in regards to Console.
When I login via Console - it already asks for TACACS's User's Credentials.

Re: AAA Authorization EXEC Default

karenmelkonyanstu — Wed, 19 Apr 2023 16:02:47 GMT

Thanks Chris,

When you say "you can use your auth profile in the policy set" , Do you refer to some TACACS Server configuraiton?
I've never configured TACACS Server so I presume you refer to it.

Re: AAA Authorization EXEC Default

Christopher Bell — Wed, 19 Apr 2023 16:42:58 GMT

Yes, my assumption was that you were using a TACACS server. If you aren't, just make sure your default group is local instead of TACACS-GROUP.