AAA problem with Nexus

[tiwang]

Hi out there

I am trying to get the config right on our nexus switches to use our local ACS server for authentication and command authorization. I of course want to make yuse of a local user-database if the connection to the central ACS server fails. But I cannot get the syntax correctly - can some please see what I am doing wrong here - se here - I have defined this on my nexus 5020:

I have defined a tacacs+ group named TACSRV

aaa group server tacacs+ TACSRV

aaa authentication login default group TACSRV

aaa authentication login console local

aaa authorization commands default group TACSRV

aaa authentication login error-enable

how should it look to first ask the servers in TACSRV and if not succesfully the local database?

best regards /ti

[Dan-Ciprian Cicioiu · Accepted solution]

Hello ,

You should add at the end of each authentication and authorization set "local"

Like this :

aaa authentication login default group TACSRV local
aaa authorization config-commands default group TACSRV local
aaa authorization commands default group TACSRV local

Dan

[tiwang]

hi out there

ok - too stupid - it is of course just the cli which doesn't show me the possibilty - the correct syntax is

aaa authorization commands default group TACSRV local

but - how can I use this command

aaa authorization commands default group TACSRV local

Can I define a collection of commands which is not default? Or what is this keyword intended to be used for?

[Dan-Ciprian Cicioiu]

Hi ,

For now , as far as i now , there is no posibility to configure the level commands as on IOS

You have only : 

  commands         Authorization for all exec-mode comamnds
  config-commands  Authorization for config comamnds

Dan