topic Re: about tacacs privilege level in Network Access Control

about tacacs privilege level

tjdwns4111 — Tue, 15 Aug 2023 07:34:41 GMT

I applied the configuration below to the router.

And when i connect to the router, it is authenticated by Tacas and immediately connects to level 15.

I want to start with level 1 and want to login level 15 by using enable command. which config should I fix?

aaa group server tacacs+ A

server name x.x.x.x

ip vrf forwarding mgmt-intf

ip tacacs source-interface GigabitEthernet0

aaa authentication login default group A local

aaa authentication enable default group A enable

aaa authorization exec default group A local

aaa authorization commands 15 default group A local

aaa accounting exec A start-stop group A

aaa accounting network A start-stop group A

aaa accounting commands 0 default start-stop group A

aaa accounting commands 1 default start-stop group A

aaa accounting commands 5 default start-stop group A

aaa accounting commands 15 default start-stop group A

tacacs-server directed-request

tacacs server x

address ipv4 x.x.x.x

key xxxx

Re: about tacacs privilege level

Mark Elsen — Tue, 15 Aug 2023 07:41:14 GMT

- FYI : https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13860-PRIV.html

Re: about tacacs privilege level

M02@rt37 — Tue, 15 Aug 2023 10:11:46 GMT

Hello @tjdwns4111,

Please remove the 'aaa authorization commands 15 default group A local' line, since you want to start with level 1.

Also, update the 'aaa authorization exec default group A local' line to include the if-authenticated keyword:

aaa authorization exec default group A if-authenticated