Controling privilege levels on PIX with Radius

[ronald_beaulieu]

We have a PIX 515 and we are trying to control privilege levels when our admins login to the console port or Telnet. we have the following config

aaa-server RADIUS (inside) host 192.168.x.x MySecretKey timeout 4

aaa authentication telnet console RADIUS

aaa authentication enable console RADIUS

aaa authentication serial console RADIUS

This allows us to have the Radius authenticate the access but once you have access you can go to Enable mode and all it does is prompt you for your Uid/pswd again.

My Radius server supports the Cisco AV Pairs so i tried adding in the users profil the attributes shell:priv-lvl=15 for admins.

I also tried adding the atribute Service-type=Login and Service-type=Administrative it still doesn't control the Enable mode access.

Any help or guidance would be appreciated.

Ronald.

[jekrauss]

Unlike the IOS on a router, there is no authorization or command authorization on the pix.

HTH

Jeff

[jekrauss]

Let me add just a clarifying comment. You can, of course, perform authorization THROUGH the PIX, just not authorization of users administering the pix - just authentication.