Setting a single global enable password

[aylmer]

Is it possible to set a single enable password for all clients that authenticate through the ACS.

Instead of setting an enable password on a per user basis I would like to set it in a single global place once that will then be used by all clients added in the future.

[vimal1980]

Yes. It is possible.

Rgds

Vimal

[aylmer]

Could you please tell me where within the ACS a global enable password can be set for all devices.

From what I have seen the only way is to set the enable password on a per user basis.

[will.shaw]

Having one single enable password does raise some security issues. However, if this is the way you wish to proceed I would recommend setting the enable password on each device instead of on the ACS (what if the ACS goes down etc...).

Then you can use the command

aaa authentication enable default group tacacs+ enable

This will tell the device to first try for a tacacs+ enable password then use the local one if that fails.

You can of course remove the 'group tacacs+' statement and use only the enable password from the device.

To centrally manage the enable password, you could use something such as Kiwi Cat Tools to automate the distribution.