03-12-2008 05:26 AM - edited 03-10-2019 03:42 PM
All, I have backed myself into a corner with a command I entered yesterday in my ASA. The command entered was:
aaa authorization command TACACS+ LOCAL
And it locked me down so tight that I can't even go into "conf t" or run a "sh run" command any longer. Like a fool, I must of ran the "copy run start" which I usually don't do, nonetheless I did, so a reboot was not able to save my error in judgement.
Does anyone know of any way to re-enable my command functions? I am running ACS 4.1. I'm thinking that it's looking for some commands that ACS says my account is permitted to run, but I'm at a loss.
03-12-2008 01:27 PM
Added a user in ACS with privilege level 15 access and in the Shell Command Authorization Set" section, checked "Per User Command Authorization" and then selected the "Permit" radio button. Submitted changes. Logged in as new user I just setup and was able to run any command needed. Whew!
08-16-2009 10:12 PM
Even i have the same issue , tried your option...but it does not work.still it give "Command authorization failed".pl help...
08-16-2009 10:43 PM
It looks like you may have missed setting up some parts of the various profiles / groups that you need to. It can be a bit trickier if you are using LDAP from the ACS server though - if this is the case for you, to get you up and running I would temporarily change and use the Local Database on the ACS server.
I would recommend going through and checking your config against the example for read/write access at: http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml
08-16-2009 11:03 PM
08-16-2009 11:20 PM
Unfortunately I can't remember off the top of my head (and am busy on my lab with some other config at the moment)....
But, are you sure the only options you have enabled in the group (or user) profile is shell and privilege ( =15)?
I suspect that PPP or callback options may be enabled but been a while since I last messed round with ACS server to remember properly....
Another thing I've just thought of - have you set up the NAD (network access device) profile as well?
08-16-2009 11:36 PM
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: