topic Re: Not able to run any command thru console (Command authorization failed) in Network Security

Not able to run any command thru console (Command authorization failed)

ohforce55 — Fri, 21 Feb 2020 14:27:40 GMT

Hi,

I currently upgraded the IOS of the firewall 5540.

Prior to the upgrade, I deleted the aaa commands in case I could get locked once it rebooted.

no aaa authentication serial console TACACS+ LOCAL
no aaa authentication enable console TACACS+ LOCAL
no aaa authorization command TACACS+ LOCAL

TACACS+ refers to the ACS.

After the upgrade, I added the aaa commands back and noticed that I couldn't run any command on console and got this error message

enc-wups-ex-vpnasa5540-1/act# sh run

Command authorization failed

As I typed any command, I got that error message.

If I removed "aaa authorization command TACACS+ LOCAL" I could run any command on console.

And, I could run any command thru SSH having those aaa commands.

My colleague resolved this issue. He said

remove it and logg off console

then add it from ssh

and then login

But I'm not sure when he said "remove it and logg off console"

Did he remove it on console? If he did, how could he remove it although he couldn't run any command?

Maybe he used local username?

Please help!

Thank you!

Re: Not able to run any command thru console (Command authorization failed)

Flavio Miranda — Mon, 09 Oct 2017 18:11:57 GMT

Hello,

At first glance, your problem looks like to be user privilege on ACS. As per your description you only upgrade the ASA but make sure everything is ok on ACS. Maybe you can delete ASA as client on ACS and add it again. Do the same for your user.

This can be some syncronization isseu between two platforms after upgrade..

-If I helped you somehow, please, rate it as useful.-

Re: Not able to run any command thru console (Command authorization failed)

ohforce55 — Mon, 09 Oct 2017 19:11:16 GMT

Hi,

Thanks for your reply.

When I checked the ACS, there was no any issue.

I don't think this is the privilege issue as well because I could run any command before the upgrade with the credential.

Re: Not able to run any command thru console (Command authorization failed)

Spooster IT Services — Wed, 11 Oct 2017 18:36:19 GMT

Hi ohforce55,

Have you checked the event logs at ACS? that will give you a good idea that why ACS is unauthorizing you to enter any command.

Re: Not able to run any command thru console (Command authorization failed)

Spooster IT Services — Wed, 11 Oct 2017 18:37:26 GMT

Hi ohforce55,

Have you checked the event logs at ACS? that will give you a good idea that why ACS is unauthorizing you to enter any command.

Re: Not able to run any command thru console (Command authorization failed)

ohforce55 — Fri, 13 Oct 2017 14:26:01 GMT

Hi,

There wasn't even the log for it since I couldn't run any command.