I have the following aaa commands on my devices
aaa new-model
aaa authentication login default group tacacs+ line
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
NOw I created a NAR to restrict (or permit) certain show commands. I have also created a separate grp. that has this NAR in it's settings.
But I notice that it does not stop any of the other commands (that I have specifically denied ) or even the unmatched arguments (box not checked)
So my question is, are my aaa commands on my device overriding these NAR's?
I tried it without the "if-authenticated" for the authorization lines but that did not help.
Any help will be greatly appreciated.
Thanks,
