Try this:
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization exec xxxxx group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 xxxxx group tacacs+ local
Then you need to go to your ACS sever and create a shell command set under Shared Profile components
The shell command set should look something like this:
(main cmd) configure
(sub cmds)
permit terminal
permit interface
permit fastethernet
permit switcthport
permit access
permit vlan
permit mode
permit spanning-tree
permit portfast
permit port-security
Check the permit box. If you want to deny them the cmd the replace permit with deny.
You can also check permit unmatched cmds arguments.
An example would be:
Clear (main cmd)
with the box checked they would have access to all of the sub commands. IE: clear counters etc...
To check and see if it is working place these lines in your aaa config:
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
This will show you what cmds are being run in the T+ admin section of ACS. CMDs that are access that they don't have access to will show up in the Failed attempts.
On a side note:
This line in your config only effects the local user name and not the ACS user name
user john privilege 5 password john
To get this to work you need to change the privilege level of the commands that you want them to have to privilege level 5 if you have a lot of AAA devices it is best to do it though the ACS server.
