EEM script with AAA radius confgured

[Romanpreet Singh]

HI

I have included the given line in my EEM script 

event manager session cli username "USER"

The "USER" is a AAA user authenticated via ACS. The fall back method for radius is local.

My question is how the authentication will work in case the router loose contact with ACS. If it falls back to local authentication, then do I need to add local username also in the EEM script or no?

[Joe Clarke]

EEM does not do anything with authentication.  It only use the session username for authorization.  If you don't have command authz configured, then you don't need to configure this user.

If you do have command authz configured, and you have a fallback to local, then you will need to configure this same user locally on the device with the appropriate authz config.

[Romanpreet Singh]

Hi Joe

Thanks for reply.

I have another doubt. I have configured "enable secret" password too. Does that have any effect on EEM script execution because we as per script we do enter "enable" command in it.

Thanks

[Joe Clarke]

Again, EEM does not do anything with authentication.  You will never need to provide a password in your policies unless you're interacting with a remote device.