We use IAS for all our AAA authenications on all of our cisco devices. All works great. We also want to be able to logon to the http-server on all the catalyst switches through AAA. But the web logon requires priv-level 15.
I have checked the cisco web site and this forum but only found instructions using TACACS+ and secure Cisco NT server.
I tried the Cisco-AV-pair value shell:priv-lel=15, with service type login or NAS-prompt. Nothing works.
Here is the eventlog message:
Event Type: Warning
Event Source: IAS
Event Category: None
Event ID: 2
Date: 5/12/2004
Time: 12:10:07 PM
User: N/A
Computer: XXXXXX
Description:
User XXXX was denied access.
Fully-Qualified-User-Name = XXXXX.com/XXX - IT/DXXXX WXXXX
NAS-IP-Address = 172.16.1.201
NAS-Identifier = <not present>
Called-Station-Identifier = <not present>
Calling-Station-Identifier = 172.16.2.106
Client-Friendly-Name = XXXMV3524
Client-IP-Address = 172.16.1.201
NAS-Port-Type = Virtual
NAS-Port = 1
Policy-Name = privilege level 15 access to Cisco
Authentication-Type = PAP
EAP-Type = <undetermined>
Reason-Code = 66
Reason = The user attempted to use an unauthorized authentication method.
Thanks!
