IOS TACACS config verify

[Steven Williams]

aaa new-model

!

!

aaa group server tacacs+ TACACS_SERVERS

server name TACACS

!

aaa authentication login TACACS_LOGIN group tacacs+ local

aaa authorization exec TACACS_LOGIN group tacacs+ local

aaa authorization network TACACS_LOGIN group tacacs+ local

!

!

tacacs server TACACS

address ipv4 10.20.0.60

key syskokey!123

!

line vty 0 4

exec-timeout 60 0

logging synchronous

login authentication TACACS_LOGIN

transport input ssh

transport output ssh

line vty 5 15

exec-timeout 60 0

login authentication TACACS_LOGIN

transport input ssh

transport output ssh

!

MacBook-Pro:~ stevewilliams$ ssh stevewilliams@10.20.42.200

Password:

TEST-1841-01>en

% Error in authentication.

TEST-1841-01>

what is missing here? I do not want the user to know the enable password so the user needs to drop right into user exec mode.

[Steven Williams]

Ok I followed this: http://www.netcontractor.pl/blog/?tag=aaa I can bypass the need for the user to enter the enable password after AD authentication but how can I get the user to drop right into User Exec mode after AD authentication?

[Javier Henderson]

Steven,

You already have the exec authorization in place, to get the user in privilege level 15 the TACACS+ server will need to provide that privilege level during the authorization phase.

[Steven Williams]

aaa authentication enable defualt none was set and the eliminated the need to enter an "enable" password, but still requires the user to enter "enable" how can we eliminate this need? I am using ISE 2.0 for TACACS+.

[nspasov]

What Javier said (+5 from me). By setting the priv level to 15 fromn your AAA server, the user will be dropped directly in the exce mode. You can also check out aaa authenticaiton enable none Which will disable the authentication for the enable mode

Thank you for rating helpful posts!

[saurabh_gera]

aaa authorization exec default group tacacs+ if-authenticated

aaa authorization commands 1 default none

aaa authorization commands 15 default group tacacs+ none .

Givethe commands Above + Set server to Provide level 15 authorized Acccess, You wont need to enter Enable Keywork.

Please Mark a Feedback if Solution Works for you, If Not Please share the Error, we Will Work Together on it.