topic Re: How can i manage enable password through acs in Network Access Control

How can i manage enable password through acs

susim — Mon, 11 Mar 2019 04:23:13 GMT

Hi all

I have couple of user in acs , all the cisco switches authentication is happening through acs( local users in acs)

and enable password locally on the switch .

Now for one user i want to mange enable password through acs

Is it possible

Thank you

Re: How can i manage enable password through acs

Javier Portuguez — Tue, 11 Feb 2014 20:19:09 GMT

Yes it is possible.

Create the user account on ACS and define the enable password for such user. Also create a shell-profile and make sure you defined the privilege level. If you define 15 - 15 it will bypass enable mode or you could do it 1 - 15.

HTH.

Re: How can i manage enable password through acs

susim — Sun, 16 Feb 2014 07:03:36 GMT

Hi Javier

I tried what you said . but did nt work

Am i missing something .

Other than this , do i need to add any commands on the switch

Re:How can i manage enable password through acs

Tushar Gaba — Sun, 16 Feb 2014 11:46:06 GMT

Hey ,

If you need to control enable authentication through ACS then we need to have command on switch .
aaa authentication enable default group tacacs enable

Once you have this command it will be a global change for all the users . Now everybody who logs in the switch will have to enter enable password which would be defined in ACS for them .

To make it short you cannot limit the enable authentication feature to a particular user .

Sent from Cisco Technical Support Android App

Re: How can i manage enable password through acs

susim — Sun, 16 Feb 2014 12:07:37 GMT

Thanks Thushar

whats default group means in " aaa authentication enable default group tacacs enable"

One more thing i would like to know

if in case tacacs down i need to login locally , for that is there anything to do ?

Thanks

Re: How can i manage enable password through acs

susim — Tue, 18 Feb 2014 08:04:56 GMT

Please advise using the below commands , is there any problem

aaa authentication login default group tacacs+ enable

aaa authentication enable default group tacacs+ enable

aaa authorization console

aaa authorization exec default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting connection default start-stop group tacacs+

Thanks

Re: How can i manage enable password through acs

kaaftab — Tue, 18 Feb 2014 10:55:30 GMT

check the following link for reference (AAA)

http://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/113590-acs5-tacacs-config.html