This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
All, I have backed myself into a corner with a command I entered yesterday in my ASA. The command entered was:
aaa authorization command TACACS+ LOCAL
And it locked me down so tight that I can't even go into "conf t" or run a "sh run" command any longer. Like a fool, I must of ran the "copy run start" which I usually don't do, nonetheless I did, so a reboot was not able to save my error in judgement.
Does anyone know of any way to re-enable my command functions? I am running ACS 4.1. I'm thinking that it's looking for some commands that ACS says my account is permitted to run, but I'm at a loss.
Added a user in ACS with privilege level 15 access and in the Shell Command Authorization Set" section, checked "Per User Command Authorization" and then selected the "Permit" radio button. Submitted changes. Logged in as new user I just setup and was able to run any command needed. Whew!
It looks like you may have missed setting up some parts of the various profiles / groups that you need to. It can be a bit trickier if you are using LDAP from the ACS server though - if this is the case for you, to get you up and running I would temporarily change and use the Local Database on the ACS server.
I would recommend going through and checking your config against the example for read/write access at: http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml
Unfortunately I can't remember off the top of my head (and am busy on my lab with some other config at the moment)....
But, are you sure the only options you have enabled in the group (or user) profile is shell and privilege ( =15)?
I suspect that PPP or callback options may be enabled but been a while since I last messed round with ACS server to remember properly....
Another thing I've just thought of - have you set up the NAD (network access device) profile as well?