topic Re: aaa authorization exec authentication-server VS auto-enable in Network Security

aaa authorization exec authentication-server VS auto-enable

johnlloyd_13 — Fri, 08 May 2020 02:08:35 GMT

hi,

was trying to google search but can't seem to find the answer.

just wondering what's the difference between aaa authorization exec authentication-server vs aaa authorization exec authentication-server auto-enable?

i know the latter since we're using them which automatically brings you to the ASA privilege exec mode # but how about the former?

ciscoasa(config)# aaa authorization exec authentication-server ?

configure mode commands/options:
auto-enable Allow authenticated users with sufficient privileges to
automatically enter privileged EXEC mode on login
<cr>

Re: aaa authorization exec authentication-server VS auto-enable

Francesco Molino — Fri, 08 May 2020 01:38:11 GMT

Hi

It will bring you to user exec mode and you'll need to type enable in order to access privileged exec mode.

Re: aaa authorization exec authentication-server VS auto-enable

johnlloyd_13 — Fri, 08 May 2020 01:56:46 GMT

hi,

so it's the same as not having this line configured at all?

we currently don't have this line configured and i have to type my TACACS login twice just to get to privilege mode.

Re: aaa authorization exec authentication-server VS auto-enable

Terence.Jh — Fri, 08 May 2020 07:23:20 GMT

Francesco is right

Re: aaa authorization exec authentication-server VS auto-enable

Francesco Molino — Sat, 09 May 2020 23:42:03 GMT

What do you mean by typing twice your login? Normally you type in once and then when you go to enable mode it prompts you for an enable password

Re: aaa authorization exec authentication-server VS auto-enable

johnlloyd_13 — Sun, 10 May 2020 01:03:04 GMT

hi,

if you don't have 'auto-enable', you'll need to type your TACACS login twice: first when you login/SSH to the ASA, then second when the ASA asked for enable password.

you don't type the 'local' enable PW when you're doing AAA/TACACS.

Re: aaa authorization exec authentication-server VS auto-enable

Francesco Molino — Sun, 10 May 2020 01:37:01 GMT

Yes but it asks for password only when typing enable not the login name.
Putting this command will allow tacacs to validate the privilege of the user and push it when entering enable command