AAA Authorization not working.

[altaf.shah]

Hi,

Currently i am configuring aaa authorization on asa 8.0, but when i enter the command "# aaa authorization command CSACS"

The current session then goes to unauthorized. and i am totally out from console. i cannot do anything.

What ever i try it says. Command Authorization Failed. Authentication is working fine.

Support Appriciated.

[Dan-Ciprian Cicioiu]

Hi ,

try to reconnect.

If you are connected without a user, or a user that is not on the ACS , after entering "aaa authorization" the equipment will send authorization requests to ACS , and the ACS will deny the request , the user being invalid.

Dan

[altaf.shah]

The user is currently in ACS, as the authentication is working fine. i am configuring using the AAA authenticated user.

Still same prob.

[Jatin Katyal]

Hi Syed,

Once you issue command authorization it will surely give you "Command authorization" error unless you have special privileges on ACS to run the commnads.

Please follow the steps in the below listed links.

ACS side configuration

Privilege for Read-Write Access or Full Access
http://tools.cisco.com/squish/7cd88

Associate the Shell Command Authorization Set (ReadWrite Access) to User Group (Admin Group)
http://tools.cisco.com/squish/2f128

Hope this helps.

Rgds,

Jatin

~Do rate helpful posts-

[altaf.shah]

Dear jkatyal

Yes i did the configuration in ACS following the same tutorial, and also Pix commands authorization set. but none working.

Even when i try to login from Console. it says Command Authorization Failed.

Getting the same error for every user.

[Jatin Katyal]

You shouldn't use PIX command authorization set and it doesn't work. Please revert to shell command authorization set. I am positive it will fix the issue.

Regards,

Jatin

Do rate helpful posts-

[altaf.shah]

Thanks for your help

But the Problem still there... Authorization not working.

is there anything i am missing?

hereis my config

Defined tacacs+ server group CSACS

Given IP Address of server + Key

and

aaa authentication ssh console CSACS LOCAL

aaa authorization command CSACS

Authentication working fine. but when i enter Authorization thats it...