privilege problem in ACS

[hacizeynal]

Hi dears ,

I have set a topology which there is ACS 5.5 and windows 2008 ,server is not working yet ,I have applied AAA methods to the just R6 and R7 ,both of them is asking for username which I created internally inside ACS  ,but there is a small problem , i created user tahir which privilege is 15 ,and user zeynal privilege 1 .when I telnet to the router I enter the username and password for zeynal ,it gives this output.

R6>show privi

Current privilege level is 1

R6>en

Password:

R6#sho

R6#show pri

R6#show privi

R6#show privilege

Current privilege level is 15

Why it turns to privilige 15 ??? I just have given to zeynal user privilege 1.

Can anyone please help me ??

[Ganesh Hariharan]

Hi dears ,

I have set a topology which there is ACS 5.5 and windows 2008 ,server is not working yet ,I have applied AAA methods to the just R6 and R7 ,both of them is asking for username which I created internally inside ACS  ,but there is a small problem , i created user tahir which privilege is 15 ,and user zeynal privilege 1 .when I telnet to the router I enter the username and password for zeynal ,it gives this output.


R6>show privi

Current privilege level is 1

R6>en

Password:

R6#sho

R6#show pri

R6#show privi

R6#show privilege

Current privilege level is 15


Why it turns to privilige 15 ??? I just have given to zeynal user privilege 1.


Can anyone please help me ??

Hi,

Without seeing the configuration it is hard to comment anything but have look on the below two links which specifically speaks about ACS 5.5 and cisco router authorisation configuration.

ACS 5.5 configuration and Authorization in cisco router

Hope it Helps..

-GI

Rate if it Helps

[hacizeynal]

aaa new-model
aaa authentication login Zeynal group tacacs+ local enable
aaa authorization exec Zeynal group tacacs+ local
aaa authorization commands 2 default group tacacs+
aaa authorization commands 2 Zeynal group tacacs+
aaa authorization commands 15 default group tacacs+
aaa authorization commands 15 Zeynal group tacacs+

[Ganesh Hariharan]

aaa new-model
aaa authentication login Zeynal group tacacs+ local enable
aaa authorization exec Zeynal group tacacs+ local
aaa authorization commands 2 default group tacacs+
aaa authorization commands 2 Zeynal group tacacs+
aaa authorization commands 15 default group tacacs+
aaa authorization commands 15 Zeynal group tacacs+

Hi,

​Try removing Zeynal with default as authorisation is coming from cisco ACS.

-GI