about tacacs privilege level

[tjdwns4111]

I applied the configuration below to the router.

And when i connect to the router, it is authenticated by Tacas and immediately connects to level 15.

I want to start with level 1 and want to login level 15 by using enable command. which config should I fix?

aaa group server tacacs+ A

 server name x.x.x.x

 ip vrf forwarding mgmt-intf

 ip tacacs source-interface GigabitEthernet0

aaa authentication login default group A local

aaa authentication enable default group A enable

aaa authorization exec default group A local

aaa authorization commands 15 default group A local

aaa accounting exec A start-stop group A

aaa accounting network A start-stop group A

aaa accounting commands 0 default start-stop group A

aaa accounting commands 1 default start-stop group A

aaa accounting commands 5 default start-stop group A

aaa accounting commands 15 default start-stop group A

tacacs-server directed-request

tacacs server x

 address ipv4 x.x.x.x

 key xxxx

[marce1000]

 - FYI : https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13860-PRIV.html

 M.

[M02@rt37 · Accepted solution]

Hello @tjdwns4111,

Please remove the 'aaa authorization commands 15 default group A local' line, since you want to start with level 1.

Also, update the 'aaa authorization exec default group A local' line to include the if-authenticated keyword:

aaa authorization exec default group A if-authenticated