aaa authorization

[elite2010]

Hi,

What is the difference between  1 and 2 

1)

aaa authorization commands default group tacacs+ none

2)

aaa authorization commands 0 default group tacacs+ local 
aaa authorization commands 10 default group tacacs+ local 
aaa authorization commands 15 default group tacacs+ local

[Arne Bier]

Option 1 will use TACACS+ to authorize every command, and at any EXEC level (0-15)

Option 2 will use TACACS+ for those specific EXEC levels only (and not for others)

[elite2010]

Hi,

Thanks for the reply 

Option 2 will use TACACS+ for those specific EXEC levels only (and not for others)

Can you explain little bit with example 

Thanks

[Arne Bier · Accepted solution]

Maybe a picture helps

Having said all that, the aaa accounting is still seen in ISE Command for all priv levels, even though I (thought I) told it to only log commands for users with level 15 - I wonder what is going on there?