Can I have a aaa config to authenticate console user locally for enable authentication.
aaa authentication login conuser local
aaa authentication login vty tacacs+ local
aaa authentication enable default tacacs+ enable
aaa authorization commands 1 default tacacs+ none
aaa authorization commands 15 default tacacs+ none
The config above allows me to authenticate console user login locally but not for enable
authentication.
ROUTER(config)#aaa authentication enable ?
default The default authentication list.
Here I don't see an option of writing the method name i.e "WORD".
If I use, 'aaa authentication enable default tacacs+ enable' by default all enable authentication
is checked for TACACS+ first and then followed by local authentication.
If I use 'aaa authentication enable default enable' the vty session will also get authenticated
locally which I do not want.
Is there any workaround for this ?
regards
Ashraf
