NCS540 tacacs failure

[ElshanMammadli5597]

We are in trouble with tacacs authentification on Cisco NCS 540.

We have configured tacacs and we can login into router but cant do any configuration and also cant do show run.

Tacacs is free tacacs server. 

RP/0/RP0/CPU0:HM(config)#router ospf test
% This command is not authorized

configuration is below

tacacs-server host 172.23.1.11 port 49
key 7 011E091752054B01204B4F070D45
single-connection

aaa group server tacacs+ tacgrp
server 172.23.1.11
!
aaa authorization exec tacauthen group tacgrp local
aaa authentication login taclogin group tacgrp local
line console
timeout login response 30
authorization exec tacauthen
login authentication taclogin
timestamp
exec-timeout 0 0
session-timeout 15
!
vty-pool default 0 99 line-template console

[M02@rt37]

Hello @ElshanMammadli5597 

Add this please :

aaa authorization commands 15 tacauthen group tacgrp local

This line ensures that any command at privilege level 15 is authorized through the TACACS+ server (and falls back to local if the server is unreachable).

[ElshanMammadli5597]

I added this command but result was same.  Do we have to add some attributes to free tacacs server?

[M02@rt37 · Accepted solution]

Hello @ElshanMammadli5597 

So tje server might not be configured to grant the appropriate privileges or command authorizations...

Ensure that the TACACS+ server is configured to assign the appropriate privilege level (e.g., level 15) when users log in. This is typically done using the priv-lvl attribute.

[ElshanMammadli5597]

You are right, for all user  coming from exteral tacacs server must be define user role (admin,operator etc). But i have tried several way but result is unsuccesfull.

[ElshanMammadli5597]

To add priv_level for users coming from tacas we have to change aaa default taskgroup