ACS - 5.3

[dpugalendi.d]

I configured the below config in Routers it is working good , but when i do the same in SWITCH-2960 , i am getting a problem not able to login to enable mode ... i am getting the basic login only ....

Error msg :   % Error in Authentication.

Need to be configured at TAFE Network Devices:

tacacs-server directed-request

tacacs-server key xxxxx        

tacacs-server host 10.61.xxxx

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication login no-tacacs none

aaa authentication enable default group tacacs+ enable

aaa authorization config-commands

aaa authorization exec default if-authenticated

aaa authorization commands 1 default if-authenticated

aaa authorization commands 15 default group tacacs+ local

aaa authorization console

=====================================================

Exit the IOS device and enter with an ACS username:

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 0 default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting connection default start-stop group tacacs+

aaa accounting system default start-stop group tacacs+

aaa session-id common

[dpugalendi.d]

ERROR MESSAGE AS BELOW .............................

HO-DC-L2-SW1-2960G>en
TAFE TACACS password:
% Error in authentication.

I am able to reset the password via TACACS but again not working for enable,

HO-DC-L2-SW1-2960G>en

TAFE TACACS password:

Enter old password:

Enter new password:

Enter new password confirmation:

% Error in authentication.

[Peter Koltl]

Check the TACACS logs

debug aaa subsystem

debug aaa authen

[AdamBlackNNT]

ACS 5.x has very extensive reporting / logging capabilties - what are you seeing in the logs when you attempt to get privileged user access?

[Satish Gaikwad]

Hi,

this is wokring for me:

aaa   new-model

aaa authentication enable   default group tacacs+ enable

aaa authorization   config-commands

aaa authorization commands 0 GRP group tacacs+

aaa authorization commands 15 GRP group tacacs+

aaa authorization exec GRP group tacacs+

aaa accounting exec default   start-stop group tacacs+

aaa accounting commands 0   default start-stop group tacacs+

aaa accounting commands 15   default start-stop group tacacs+

At enable prompt enter the first level pwd only.

Ensure you have

System Administration > Users > Authentication Settings>TACACS Enable Password enabled.

Thanks