AAA Authorization fail in line console

[itzikk]

Hi,

I`m trying to understand what is missing.

I Configured in my switch to authenticate and authorize VTY connections via Radius servers.

The console connection I left to be authenticated and authorized using Local credentials.

the command are:

aaa new-model

aaa group server radius radius-verify

server-private 10.10.10.1 auth-port 1812 acct-port 1813 key *******

server-private 10.10.10.2 auth-port 1812 acct-port 1813 key *******

aaa authentication login aaa-login group radius-verify local

aaa authentication login default local

aaa authorization exec aaa-auth group radius-verify local

aaa authorization exec default local

aaa authorization console

line vty 0 15

login authentication aaa-login

authorization exec aaa-auth

line con 0

login authentication default

authorization exec default

When i connect via SSH - im authenticated directly into Config mode, as i wanted.

but when i try to connect via Console - im getting the error: Authorization Failed.

It seems like it authenticates me locally, but try to give me authorization via other thing.

when i ran debug aaa authorization, i saw zero logs.

I want to be able connecting via Console using local credentials and directly into Config mode.

Any advice?

Thanks

[MHM Cisco World]

I dont like config any AAA under console' console is your last hope if you can not access to SW via vty.

Config it with AAA and there is issue in connect to AAA can make you never access to SW via console.

But if you want go that way

Check 

aaa authorization console <- I think there is conflict between it and aaa authorization exec

MHM

[MHM Cisco World]

First dont WR NEVER when you do any change to aaa' in case that something wrong you can reboot and return to old config.

Now use different method dont use defualt for console auth and authz

Try and check

MHM

[M02@rt37]

Hello @itzikk 

Add this

aaa authorization console local

[paul driver]

Hello
Append the following:
username xxx privilege 15 secret ccc
aaa authentication login default local
aaa authorization exec default local if-authenticated

[itzikk]

Thanks all,

Unfortunately, it`s not resolving the issue.

What i`m trying to make is that my VTY connections will be authenticated via Radius servers directly into Privileged exec mode.  On the same time, i want my Console connection to authenticate using local credentials.

I manage to login the VTY lines directly into Privileged exec mode by using the command: aaa authorization exec aaa-auth group radius-verify local

By default, line con 0 is not using authorization, so i assumed it will connect without authorization, but i did get "Authorization Failed". That`s why i configured aaa authentication login default local if-authenticated, But still got the same error of Authorization Failed.

I noticed that when I write under the VTY lines "no authorization exec aaa-auth", I login into User exec mode, and when i try with my console line i`m able to login with no error.

Conclusion: for some reason, as long as i use aaa named method of authorization under VTY lines, it is affecting the Console line also, although the the console by default shouldnt be affected by the aaa authorization.

Any thoughts?

[MHM Cisco World]

Same config you share in your original post 

Clear line vty all

Then try only access to console

Maybe us same username in to vty and console effect the authz

MHM

[itzikk]

The only difference between line vty now and con 0 is that line vty uses named authentication list forwarding to Radius group, and the console uses the default one using local credentials.

The aaa authorization is:

aaa authorization exec default local if-authenticated

Im able to connect on both VTY and Console lines.

But, in VTY im connecting only to User mode, and i want to connect directly into Privileged mode.

The moment i configure named authorization forwarding to radius, and configure it under VTY, im getting Error in the console login "Authorization Failed"

[MHM Cisco World]

I will do some test to check. 

Update you soon 

MHM

[itzikk]

As i find out, there is a bug in my Switch and thats the reason it wasn`t working well.

Tried in another switch and worked fine. 

thanks

[MHM Cisco World]

Thanks alot  for update us

Can yoh share the bug id 

Thanks again 

MHM