Command authorization failed

[ohareka70]

Hello,

I have software tokens in the Gemalto Cloud for 2Factor Authentication and its working ok for Cisco Any Connect remotely
I can also login to routers and switches successfully but once they login they get ...

conf t
Command authorization failed

With a clear text password from the ACS server its fine but not using the 2FA

Cisco ACS server - aaa status says - Authentication succeeded
When the user authenticates their is a record of the request in the Gemalto Cloud snapshot.  As it is registering success in the portal then the authentication from a STA (auth) perspective is closed.

Is the issue on the ACS or even the switch itself?

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+

[balaji.bandi]

There are 2 issues we see here.

1. check first with out any 2facto authentication. is that working with TACACS

2. Safenet have issue with some special charcter in the Password it will not take it.(make sure user password not have any $ or £ kind of symbols).

[ohareka70]

BB

The password generated by Safenet is a 6 digit random number.  It works ok when i authenticate to a router or switch using tacacs.  Its only when i go to do a sh run etc that the authorization is failing.  I am not sure what its looking for.  The router or switch is fine if i use the same tacacs account with a clear text password

[balaji.bandi · Accepted solution]

Look at the Logs in TACACS Server it will give clue based on the profile

[ohareka70]

I found the logs under monitoring and reporting

Authentication was ok but not authorization

Once i added in the new group for 2FA it was ok

Thanks

Kevin