topic Re: Command Set Authorization in ACS 5.0 in Network Access Control

Command Set Authorization in ACS 5.0

estelamathew — Fri, 21 Feb 2020 18:25:47 GMT

Hello Federico,

Attached is what i have done for command authorization for privilege level user 2,

Pls Pls Pls help to get success for this issue as it is pending very long from my end.

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Mon, 10 Jan 2011 08:56:18 GMT

Hi Mathew,

Thank you for posting again on CSC.

Could you please confirm what is the issue exactly?

For example, are users on privilege level 2 not able to type any debug command?

What is the error message that the switch is returning?

Looking at the ACS configuration, everything looks OK for what concerns the authorization rule.

In the command set however, I could see that the permitted "debug" and "undebug" commands have no arguments.

This could cause users to be authorized to type "debug", but not "debug ip packet" for example.

If you'd like to permit any argument for a specific command, you should make sure to define the argument as a star *

Let me know if this helps,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Mon, 10 Jan 2011 20:20:18 GMT

Hello Federico,

Very Happy to see ur reply,hope we will reach to success for this thread.

For example, are users on privilege level 2 not able to type any debug command? What is the error message that the switch is returning?

when user login by his username and password in switch he is in exec mode ( >) instead of privilege (#) mode.The username and password and user level 2 are set on ACS not configured in switch.

I wanna authorize some commands for user level 2 denug and undebug

If you'd like to permit any argument for a specific command, you should make sure to define the argument as a star *

Atleast i should get the privilege (#) prompt to type debug or undebug command

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Tue, 11 Jan 2011 07:38:17 GMT

Hi Mathew,

If you are assigning privilege level 2 to users, it is expected that the first prompt will be the one for the exec mode (>).

In order to enter the privilege mode you'd need to type the "enable" command.

Only users in privilege mode 15 could be expected to be prompted for the enable mode directly (#).

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Tue, 11 Jan 2011 07:50:55 GMT

Hello Federico,

When i execute a command username cisco privilege 2 password cisco on switch it direct drops me in privilege mode of level 2 (#) BUT when the user is only configured in ACS then it drops me in (>) ,

If i agree on your above words then i don't see any debug and undebug commands in ( >) mode for the particular user level 2

Thanks.

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Tue, 11 Jan 2011 08:21:20 GMT

Hi Mathew,

If possible, would you mind attaching the configuration from your switch?

Usually, debug commands for privilege level 2 users should be available after entering the enable mode.

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Tue, 11 Jan 2011 11:25:46 GMT

Hello Federico,

Attached are the switch configs related to AAA,

Usually, debug commands for privilege level 2 users should be available after entering the enable mode.

But i m not able to get into enable mode after putting username and password it gives me (>) prompt please see in the attached.

Thanks

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Tue, 11 Jan 2011 11:34:00 GMT

Hi Mathew,

In order to also enable authorization for commands on privilege level 2, you should add the following line to the switch:

aaa authorization commands 2 rus group tacacs+

line vty 0 4

authorization commands 2 rus

or simply

aaa authorization commands 2 default group tacacs+

Before playing with commands authorization, you may want to save the config on the switch (write memory). In case you'd accidently kick you out of command authorization, you could simply reload the switch so that you'll loose only the latest commands authorization changes.

Regarding the enable mode (#), when you are at the > prompt, please type "enable" and then enter.

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Tue, 11 Jan 2011 13:20:06 GMT

Hello Federico,

Regarding the enable mode (#), when you are at the > prompt, please type "enable" and then enter.

It does'nt accepts,without any password,

Thanks

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Tue, 11 Jan 2011 14:08:23 GMT

Hi Mathew,

Let's quickly take a step backwards.

I quickly tested a simple config in our lab that, ported to your "rus" method, it should look like the following:

aaa authentication login rus group tacacs+

aaa authorization exec rus group tacacs+

aaa authorization commands 0 rus group tacacs+

aaa authorization commands 1 rus group tacacs+

aaa authorization commands 2 rus group tacacs+

aaa authorization commands 15 rus group tacacs+

line vty 0 4

authorization commands 0 rus

authorization commands 1 rus

authorization commands 2 rus

authorization commands 15 rus

authorization exec rus

On ACS, the shell profile with privilege level 2 and command set for "debug .*" should be the one to use. So please be sure that under the argument of the debug command in the ACS command set you specify '.*' that means any argument.

Also, please note that "debug" commands on the switch are not available under privilege level 2 by default. So we'd also need to move the "debug" commands and all the needed arguments under privilege level 2:

privilege exec level 2 debug radius

privilege exec level 2 debug aaa authentication

privilege exec level 2 debug aaa authorization

etc.

Let me know if this helps,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Tue, 11 Jan 2011 21:27:03 GMT

Hello Federico,

Very Nice Example,

From ur example and attched PDF files i came to know that We have to apply privilege level commands on switch as well as on ACS server so that's the reason i was not able to authorize the command ??? If we have to apply on both the switch and ACS then why we need ACS server????????

But after applying also i m not able to authenticate (error in authentication ) untill and unless i specify the command enable secret level 2 cisco on switch when i try to login after username and password it ask's me for enable password , when i put the command switch > enable 2 and after than password than only i m placed in privilege level 2 and i m authorize to apply those debug and undebug commands. pls have a look on the attached.

On ACS server when i create the username there are two options for password 1st option is user's password and 2nd option is enable password, this enable password specify to which level ??? I tried putting level 2 password but not accepted when i do telnet.when i apply enable secret level 2 cisco on switch than only it alllows me to enter in privilege level 2 mode.pls have a look on the attached.

I have also creted 1 user with username xyz privilege 15 password cisco when the user telnet and put his username and password he is placed in user exec mode ( >) instead of privilege mode (#) of level 15. Again i have to put the enable secret password of level 15 than only the user is placed in privilege 15.

Please have a look on the attached PDF files in section Task 4.1, Task 4.3,Task 4.4, Task 4.5,Ur example procedure is same mathching PDF

Thanks

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Wed, 12 Jan 2011 09:56:56 GMT

Hi Mathew,

Few clarifications needed here:

1. We don't apply the same config for privileges/command on both the ACS and the swith.

On ACS we need to define which commands are allowed in the command set.

On the switch, if you have a user logged in with a certain privilege, and you want to authorize commands that are by default available only on a different privilege, then you need to move those commands to the user's privilege level where you want to have them.

2. No need for extra enable passwords on ACS as long as the switch is not configured to ask for one.

Please re-attach an updated version of your switch's configuration so to double check that it is aligned with what I tested here.

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Thu, 13 Jan 2011 07:44:38 GMT

Hello Federico,

We don't apply the same config for privileges/command on both the ACS and the swith.
On ACS we need to define which commands are allowed in the command set.
On the switch, if you have a user logged in with a certain privilege, and you want to authorize commands that are by default available only on a different privilege, then you need to move those commands to the user's privilege level where you want to have them.

I did'nt understood what are u trying to explain But what i understand is the command set what we r permitting on switch is the same commands we r permitting on ACS, then what is the difference, Attached is the command set what i permitted on ACS and the same commands on switch.

. No need for extra enable passwords on ACS as long as the switch is not configured to ask for one

This enable passord on ACS refers where????

version 12.2
no service pad

enable secret level 2 5 $1$3JuM$Qwx9ZmRixfbsnQ5YvoByh0
enable secret 5 $1$bHw2$ZGFSLF2ZaYxwn/6wDhf9J.
!
username abc password 7 094F5B5E41531A
username XYZ privilege 15 password 7 00071A150754
username XXX password 7 06051A76141804

aaa new-model
aaa authentication login rus group tacacs+ local
aaa authentication login console none
aaa authorization exec default group tacacs+
aaa authorization commands 2 default group tacacs+
tacacs-server host 10.75.X.X key 7 01100F175804
tacacs-server directed-request
radius-server source-ports 1645-1646
ip tacacs source-interface vlan 120
privilege exec level 2 undebug all
privilege exec level 2 undebug
privilege exec level 2 debug all
privilege exec level 2 debug
!
line con 0
logging synchronous
login authentication console
line vty 0 4
password 7 03074E5C5E592C
login authentication rus
line vty 5 15
password 7 000706515C0D06
login authentication rus

Thanks

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Thu, 13 Jan 2011 08:26:50 GMT

Thank you Mathew,

Let me restate the previous points:

1. But what i understand is the command set what we r permitting on switch is the same commands we r permitting on ACS, then what is the difference?

[A] On the switch we are not permitting any set of commands: we are moving the commands that we permit through ACS to the privilege level 2 of the user we want to use.

The commands are permitted by ACS, not by the switch.

But we need to move the "debug" commands on the switch to privilege level 2, otherwise a user on privilege level 2 will not be able to see them.

2. The configuration you applied on your switch is not the same that I tested and recommended:

2a) You have

aaa authentication login rus group tacacs+ local

aaa authentication login console none

aaa authorization exec default group tacacs+

aaa authorization commands 2 default group tacacs+

This should be changed to

aaa authentication login rus group tacacs+

aaa authentication login console none

aaa authorization exec rus group tacacs+

aaa authorization commands 0 rus group tacacs+

aaa authorization commands 1 rus group tacacs+

aaa authorization commands 2 rus group tacacs+

aaa authorization commands 15 rus group tacacs+

2b) You have

line vty 0 4

password 7 03074E5C5E592C

This should be changed to

line vty 0 4

authorization commands 0 rus

authorization commands 1 rus

authorization commands 2 rus

authorization commands 15 rus

authorization exec rus

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Thu, 13 Jan 2011 10:02:35 GMT

Hello Federico,

Please be patients with me,and i appreciate for being with me for this thread,GOD Bless U .

[A] On the switch we are not permitting any set of commands: we are moving the commands that we permit through ACS to the privilege level 2 of the user we want to use.

The commands are permitted by ACS, not by the switch.

But we need to move the "debug" commands on the switch to privilege level 2, otherwise a user on privilege level 2 will not be able to see them.

This can be done without ACS also ???. I can move commands on privilege level 2 and i can give access to certain users on level 2 with enable secret password and they can execute the commands.

Here are the configs:

aaa new-model
aaa authentication login rus group tacacs+ local
aaa authentication login console none
aaa authorization exec rus group tacacs+
aaa authorization commands 2 rus group tacacs+

privilege exec level 2 undebug all
privilege exec level 2 undebug
privilege exec level 2 debug all
privilege exec level 2 debug
!
line con 0
logging synchronous
login authentication console
line vty 0 4
password 7 03074E5C5E592C
authorization commands 2 rus
authorization exec rus
login authentication rus
line vty 5 15
password 7 000706515C0D06
login authentication rus

authorization commands 2 rus
authorization exec rus
!
end

Federico the privilege commands are very much FAR for me i can't even go to the (#) prompt after appying username and password. Just have a look below.

username:cisco
password:

Class_room_105>en ???? (this is were i m stuck to give password which password i shld give here if i dont create a enable secret level 2 password)

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Thu, 13 Jan 2011 10:37:00 GMT

Hi Mathew,

Could you please align 100% your configuration with mine?

You have

aaa authentication login rus group tacacs+ local

aaa authentication login console none

aaa authorization exec rus group tacacs+

aaa authorization commands 2 rus group tacacs+

This should be changed to

aaa authentication login rus group tacacs+

aaa authentication login console none

aaa authorization exec rus group tacacs+

aaa authorization commands 0 rus group tacacs+ (missing)

aaa authorization commands 1 rus group tacacs+ (missing)

aaa authorization commands 2 rus group tacacs+

aaa authorization commands 15 rus group tacacs+ (missing)

You have

line vty 0 4

password 7 03074E5C5E592C

authorization commands 2 rus

authorization exec rus

This should be changed to

line vty 0 4

no password 7 03074E5C5E592C

authorization commands 0 rus (missing)

authorization commands 1 rus (missing)

authorization commands 2 rus

authorization commands 15 rus (missing)

authorization exec rus

If this still doesn't work, please collect the following debugs while logging in with a privilege 2 user and trying to go in enable mode:

debug aaa authentication

debug aaa authorization

debug tacacs

term mon (if connecting via telnet)

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Thu, 13 Jan 2011 11:15:16 GMT

Hello Federico ,

I have been kicked out after applying those commands, I can't reload the switch as i m far away any command that can remove those command

Thanks

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Thu, 13 Jan 2011 11:32:24 GMT

Hi Mathew,

That's why my recommendation regarding being ready to reload the switch when playing with authorization... 😉

You may get around this by making sure that you have a user on ACS 5 for which you are passing back privilege level 15 and permitting all the commands.

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Command Set Authorization in ACS 5.0

estelamathew — Thu, 13 Jan 2011 11:58:36 GMT

Hello,

I m trying on different switch.The configs are same as below,as only the group name of tacacs server is changed from rus to sur

aaa new-model
aaa authentication login sur group tacacs+ local
aaa authentication login console none
aaa authorization exec sur group tacacs+
aaa authorization commands 2 sur group tacacs+

privilege exec level 2 undebug all
privilege exec level 2 undebug
privilege exec level 2 debug all
privilege exec level 2 debug
!
line con 0
logging synchronous
login authentication console
line vty 0 4
password 7 03074E5C5E592C
authorization commands 2 sur
authorization exec sur
login authentication sur
line vty 5 15
password 7 000706515C0D06
login authentication sur
authorization commands 2 sur
authorization exec sur
!

!
end

I m getting the same error as such below.

username:cisco
password:

Class_room_105>en

Here is the output.

*Mar 17 07:53:29.817: AAA: parse name=tty2 idb type=-1 tty=-1
*Mar 17 07:53:29.817: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=2 channel=0
*Mar 17 07:53:29.817: AAA/MEMORY: create_user (0x1BCE4F0) user='NULL' ruser='NULL' ds0=0 port='tty2' rem_addr='10.75.7.130' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)
*Mar 17 07:53:29.817: AAA/AUTHEN/START (936946286): port='tty2' list='sur' action=LOGIN service=LOGIN
*Mar 17 07:53:29.817: AAA/AUTHEN/START (936946286): found list sur
*Mar 17 07:53:29.817: AAA/AUTHEN/START (936946286): Method=tacacs+ (tacacs+)
*Mar 17 07:53:29.817: TAC+: send AUTHEN/START packet ver=192 id=936946286
*Mar 17 07:53:29.817: TAC+: Using default tacacs server-group "tacacs+" list.
*Mar 17 07:53:29.817: TAC+: Opening TCP/IP to 10.75.7.135/49 timeout=5
*Mar 17 07:53:29.817: TAC+: Opened TCP/IP handle 0x1B56938 to 10.75.7.135/49 using source 10.75.120.9
*Mar 17 07:53:29.817: TAC+: 10.75.7.135 (936946286) AUTHEN/START/LOGIN/ASCII queued
*Mar 17 07:53:30.019: TAC+: (936946286) AUTHEN/START/LOGIN/ASCII processed
*Mar 17 07:53:30.019: TAC+: ver=192 id=936946286 received AUTHEN status = GETUSER
*Mar 17 07:53:30.019: AAA/AUTHEN (936946286): status = GETUSER
*Mar 17 07:53:36.377: AAA/AUTHEN/CONT (936946286): continue_login (user='(undef)')
*Mar 17 07:53:36.377: AAA/AUTHEN (936946286): status = GETUSER
*Mar 17 07:53:36.385: AAA/AUTHEN (936946286): Method=tacacs+ (tacacs+)
*Mar 17 07:53:36.385: TAC+: send AUTHEN/CONT packet id=936946286
*Mar 17 07:53:36.385: TAC+: 10.75.7.135 (936946286) AUTHEN/CONT queued
*Mar 17 07:53:36.587: TAC+: (936946286) AUTHEN/CONT processed
*Mar 17 07:53:36.587: TAC+: ver=192 id=936946286 received AUTHEN status = GETPASS
*Mar 17 07:53:36.587: AAA/AUTHEN (936946286): status = GETPASS
*Mar 17 07:53:45.160: AAA/AUTHEN/CONT (936946286): continue_login (user='cisco')
*Mar 17 07:53:45.160: AAA/AUTHEN (936946286): status = GETPASS
*Mar 17 07:53:45.160: AAA/AUTHEN (936946286): Method=tacacs+ (tacacs+)
*Mar 17 07:53:45.160: TAC+: send AUTHEN/CONT packet id=936946286
*Mar 17 07:53:45.160: TAC+: 10.75.7.135 (936946286) AUTHEN/CONT queued
*Mar 17 07:53:45.361: TAC+: (936946286) AUTHEN/CONT processed
*Mar 17 07:53:45.361: TAC+: ver=192 id=936946286 received AUTHEN status = PASS
*Mar 17 07:53:45.361: AAA/AUTHEN (936946286): status = PASS
*Mar 17 07:53:45.361: TAC+: Closing TCP/IP 0x1B56938 connection to 10.75.7.135/49
*Mar 17 07:53:45.361: tty2 AAA/AUTHOR/EXEC (2947805954): Port='tty2' list='sur' service=EXEC
*Mar 17 07:53:45.361: AAA/AUTHOR/EXEC: tty2 (2947805954) user='cisco'
*Mar 17 07:53:45.361: tty2 AAA/AUTHOR/EXEC (2947805954): send AV service=shell
*Mar 17 07:53:45.361: tty2 AAA/AUTHOR/EXEC (2947805954): send AV cmd*
*Mar 17 07:53:45.361: tty2 AAA/AUTHOR/EXEC (2947805954): found list "sur"
*Mar 17 07:53:45.361: tty2 AAA/AUTHOR/EXEC (2947805954): Method=tacacs+ (tacacs+)
*Mar 17 07:53:45.361: AAA/AUTHOR/TAC+: (2947805954): user=cisco
*Mar 17 07:53:45.361: AAA/AUTHOR/TAC+: (2947805954): send AV service=shell
*Mar 17 07:53:45.361: AAA/AUTHOR/TAC+: (2947805954): send AV cmd*
*Mar 17 07:53:45.361: TAC+: using previously set server 10.75.7.135 from group tacacs+
*Mar 17 07:53:45.361: TAC+: Opening TCP/IP to 10.75.7.135/49 timeout=5
*Mar 17 07:53:45.361: TAC+: Opened TCP/IP handle 0x1B1D86C to 10.75.7.135/49 using source 10.75.120.9
*Mar 17 07:53:45.361: TAC+: Opened 10.75.7.135 index=1
*Mar 17 07:53:45.361: TAC+: 10.75.7.135 (2947805954) AUTHOR/START queued
*Mar 17 07:53:45.563: TAC+: (2947805954) AUTHOR/START processed
*Mar 17 07:53:45.563: TAC+: (2947805954): received author response status = PASS_ADD
*Mar 17 07:53:45.563: TAC+: Closing TCP/IP 0x1B1D86C connection to 10.75.7.135/49
*Mar 17 07:53:45.563: AAA/AUTHOR (2947805954): Post authorization status = PASS_ADD
*Mar 17 07:53:45.563: AAA/AUTHOR/EXEC: Authorization successful
*Mar 17 07:53:51.233: %SYS-4-CONFIG_RESOLVE_FAILURE: System config parse from (tftp://255.255.255.255/network-confg) failed
*Mar 17 07:53:59.244: AAA/MEMORY: dup_user (0x1B3011C) user='cisco' ruser='NULL' ds0=0 port='tty2' rem_addr='10.75.7.130' authen_type=ASCII service=ENABLE priv=15 source='AAA dup enable'
*Mar 17 07:53:59.244: AAA/AUTHEN/START (3747472480): port='tty2' list='sur' action=LOGIN service=ENABLE
*Mar 17 07:53:59.244: AAA/AUTHEN/START (3747472480): non-console enable - default to enable password
*Mar 17 07:53:59.244: AAA/AUTHEN/START (3747472480): Method=ENABLE
*Mar 17 07:53:59.244: AAA/AUTHEN (3747472480): status = GETPASS
*Mar 17 07:54:07.037: AAA/AUTHEN/CONT (3747472480): continue_login (user='(undef)')
*Mar 17 07:54:07.037: AAA/AUTHEN (3747472480): status = GETPASS
*Mar 17 07:54:07.037: AAA/AUTHEN/CONT (3747472480): Method=ENABLE
*Mar 17 07:54:07.054: AAA/AUTHEN (3747472480): password incorrect
*Mar 17 07:54:07.054: AAA/AUTHEN (3747472480): status = FAIL
*Mar 17 07:54:07.054: AAA/MEMORY: free_user (0x1B3011C) user='NULL' ruser='NULL' port='tty2' rem_addr='10.75.7.130' authen_type=ASCII service=ENABLE priv=15
*Mar 17 07:54:15.275: %SYS-4-CONFIG_RESOLVE_FAILURE: System config parse from (tftp://255.255.255.255/cisconet.cfg) failed
*Mar 17 07:54:28.579: AAA/MEMORY: free_user (0x1BCE4F0) user='cisco' ruser='NULL' port='tty2' rem_addr='10.75.7.130' authen_type=ASCII service=LOGIN priv=1
*Mar 17 07:54:34.275: %SYS-4-CONFIG_RESOLVE_FAILURE: System config parse from (tftp://255.255.255.255/lab_7_sw1-confg) failed
*Mar 17 07:54:58.317: %SYS-4-CONFIG_RESOLVE_FAILURE: System config parse from (tftp://255.255.255.255/lab_7_sw.cfg) failed

Thanks

Re: Command Set Authorization in ACS 5.0

Federico Ziliotto — Thu, 13 Jan 2011 12:12:38 GMT

Hi Mathew,

This what I am getting on my switch, up to the # prompt, without typing any commands and without the need to go through the > prompt:

Jan 13 14:01:58.400 CET: AAA/BIND(00000075): Bind i/f

Jan 13 14:01:58.400 CET: AAA/AUTHEN/LOGIN (00000075): Pick method list 'MyTacacs'

Jan 13 14:01:58.400 CET: TPLUS: Queuing AAA Authentication request 117 for processing

Jan 13 14:01:58.400 CET: TPLUS: processing authentication start request id 117

Jan 13 14:01:58.400 CET: TPLUS: Authentication start packet created for 117()

Jan 13 14:01:58.408 CET: TPLUS: Using server 10.48.76.77

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/NB_WAIT/4C8E878: Started 5 sec timeout

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/NB_WAIT: socket event 2

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/NB_WAIT: wrote entire 37 bytes request

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/READ: Would block while reading

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/READ: read entire 12 header bytes (expect 15 bytes data)

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/READ: read entire 27 bytes response

Jan 13 14:01:58.408 CET: TPLUS(00000075)/0/4C8E878: Processing the reply packet

Jan 13 14:01:58.408 CET: TPLUS: Received authen response status GET_USER (7)

Jan 13 14:02:02.191 CET: TPLUS: Queuing AAA Authentication request 117 for processing

Jan 13 14:02:02.191 CET: TPLUS: processing authentication continue request id 117

Jan 13 14:02:02.191 CET: TPLUS: Authentication continue packet generated for 117

Jan 13 14:02:02.191 CET: TPLUS(00000075)/0/WRITE/4B830B4: Started 5 sec timeout

Jan 13 14:02:02.191 CET: TPLUS(00000075)/0/WRITE: wrote entire 23 bytes request

Jan 13 14:02:02.191 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:02:02.191 CET: TPLUS(00000075)/0/READ: read entire 12 header bytes (expect 15 bytes data)

Jan 13 14:02:02.191 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:02:02.191 CET: TPLUS(00000075)/0/READ: read entire 27 bytes response

Jan 13 14:02:02.191 CET: TPLUS(00000075)/0/4B830B4: Processing the reply packet

Jan 13 14:02:02.191 CET: TPLUS: Received authen response status GET_PASSWORD (8)

Jan 13 14:02:04.289 CET: TPLUS: Queuing AAA Authentication request 117 for processing

Jan 13 14:02:04.289 CET: TPLUS: processing authentication continue request id 117

Jan 13 14:02:04.289 CET: TPLUS: Authentication continue packet generated for 117

Jan 13 14:02:04.289 CET: TPLUS(00000075)/0/WRITE/4B830B4: Started 5 sec timeout

Jan 13 14:02:04.289 CET: TPLUS(00000075)/0/WRITE: wrote entire 22 bytes request

Jan 13 14:02:04.305 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:02:04.305 CET: TPLUS(00000075)/0/READ: read entire 12 header bytes (expect 6 bytes data)

Jan 13 14:02:04.305 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:02:04.305 CET: TPLUS(00000075)/0/READ: read entire 18 bytes response

Jan 13 14:02:04.305 CET: TPLUS(00000075)/0/4B830B4: Processing the reply packet

Jan 13 14:02:04.305 CET: TPLUS: Received authen response status PASS (2)

Jan 13 14:02:04.305 CET: AAA/AUTHOR (0x75): Pick method list 'MyTacacs'

Jan 13 14:02:04.305 CET: TPLUS: Queuing AAA Authorization request 117 for processing

Jan 13 14:02:04.305 CET: TPLUS: processing authorization request id 117

Jan 13 14:02:04.305 CET: TPLUS: Protocol set to None .....Skipping

Jan 13 14:02:04.305 CET: TPLUS: Sending AV service=shell

Jan 13 14:02:04.305 CET: TPLUS: Sending AV cmd*

Jan 13 14:02:04.305 CET: TPLUS: Authorization request created for 117(zilli2)

Jan 13 14:02:04.305 CET: TPLUS: using previously set server 10.48.76.77 from group tacacs+

Jan 13 14:02:04.305 CET: TPLUS(00000075)/0/NB_WAIT/41EE6AC: Started 5 sec timeout

Jan 13 14:02:04.314 CET: TPLUS(00000075)/0/NB_WAIT: socket event 2

Jan 13 14:02:04.314 CET: TPLUS(00000075)/0/NB_WAIT: wrote entire 62 bytes request

Jan 13 14:02:04.314 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:02:04.314 CET: TPLUS(00000075)/0/READ: Would block while reading

Jan 13 14:02:04.322 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:02:04.331 CET: TPLUS(00000075)/0/READ: read entire 12 header bytes (expect 17 bytes data)

Jan 13 14:02:04.331 CET: TPLUS(00000075)/0/READ: socket event 1

Jan 13 14:02:04.331 CET: TPLUS(00000075)/0/READ: read entire 29 bytes response

Jan 13 14:02:04.331 CET: TPLUS(00000075)/0/41EE6AC: Processing the reply packet

Jan 13 14:02:04.331 CET: TPLUS: Processed AV priv-lvl=2

Jan 13 14:02:04.331 CET: TPLUS: received authorization response for 117: PASS

Jan 13 14:02:04.331 CET: AAA/AUTHOR/EXEC(00000075): processing AV cmd=

Jan 13 14:02:04.331 CET: AAA/AUTHOR/EXEC(00000075): processing AV priv-lvl=2

Jan 13 14:02:04.331 CET: AAA/AUTHOR/EXEC(00000075): Authorization successful

In your case, what is currently missing is the privilege level passed back by ACS:

Jan 13 14:02:04.331 CET: TPLUS(00000075)/0/41EE6AC: Processing the reply packet

Jan 13 14:02:04.331 CET: TPLUS: Processed AV priv-lvl=2

Jan 13 14:02:04.331 CET: TPLUS: received authorization response for 117: PASS

Jan 13 14:02:04.331 CET: AAA/AUTHOR/EXEC(00000075): processing AV cmd=

Jan 13 14:02:04.331 CET: AAA/AUTHOR/EXEC(00000075): processing AV priv-lvl=2

Jan 13 14:02:04.331 CET: AAA/AUTHOR/EXEC(00000075): Authorization successful

As mentioned, I'd recommend to align your switch's config with mine and to check the authentication and authorization logs on ACS Monitoring&Report under

Catalog > AAA > TACACS_Authentication

Catalog > AAA > TACACS_Authorization

Regards,

Fede

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.