aaa new-model enable prompt ?

[tedauction]

Hello, how can completely remove the need to enter 'enable' when using 'aaa new-model'.

e.g.

 I have Cisco switches configured with usernames e.g.

user myUser privilege 15 secret 5 xxxxxxxx

Then I have my vty lines configured as such:

line vty 0 4
login local
transport input ssh

So with this config, I just log in with username/password and then I am automatically at the privileged exec prompt with privilege level 15.

However, now I want to use 802.1x port-based authentication so I enter the command 'aaa new-model'.

Now I have the problem whereby I log in to a vty line, but only arrive at the executive prompt and require an enable password to proceed.

So I now have an extra step (enable password) to log in to my devices simply because I enabled 'aaa new-model'.

Is there any way to enable 'aaa new-model' without it incurring the need for me to 'enable' in to my devices ?

n.b. I can avoid the need for the enable password if I enter 'privilege level 15' within line vty 0 4, however I also have another user account on these devices which should not have privilege level 15 so this method is no good for me.

Or I could enter 'aaa authentication enable default none' which negates the need for an enable password, but I still need to enter the command 'enable' to enter priviliege exec mode. How can completely remove the need to enter 'enable' when using 'aaa new-model'.

Thank you kindly.

[Reza Sharifi]

Hi,

Do you have this command:

aaa authentication enable default group ....

If you want to go directly to enable mode than you don't need the above command.

HTH

[paul driver · Accepted solution]

Hello

Basic AAA would be-;

username stan privilege 15 secret stan
aaa new-model
aaa authentication login default local
aaa authentication enable default enable
aaa authorization console
aaa authorization exec default local if-authenticated

res
Paul