aaa authorization exec authentication-server VS auto-enable

[johnlloyd_13]

hi,

was trying to google search but can't seem to find the answer.

just wondering what's the difference between aaa authorization exec authentication-server vs aaa authorization exec authentication-server auto-enable?

i know the latter since we're using them which automatically brings you to the ASA privilege exec mode # but how about the former?

ciscoasa(config)# aaa authorization exec authentication-server ?

configure mode commands/options:
auto-enable Allow authenticated users with sufficient privileges to
automatically enter privileged EXEC mode on login
<cr>

[Francesco Molino]

Hi

It will bring you to user exec mode and you'll need to type enable in order to access privileged exec mode.

[johnlloyd_13]

hi,

so it's the same as not having this line configured at all?

we currently don't have this line configured and i have to type my TACACS login twice just to get to privilege mode.

[Francesco Molino]

What do you mean by typing twice your login? Normally you type in once and then when you go to enable mode it prompts you for an enable password

[johnlloyd_13]

hi,

if you don't have 'auto-enable', you'll need to type your TACACS login twice: first when you login/SSH to the ASA, then second when the ASA asked for enable password.

you don't type the 'local' enable PW when you're doing AAA/TACACS.

[Francesco Molino]

Yes but it asks for password only when typing enable not the login name.
Putting this command will allow tacacs to validate the privilege of the user and push it when entering enable command

[Terence.Jh]

Francesco is right