Hi All,
So I have RADIUS with Microsoft NPS successfully working on my IE2000, 3000 switches with the WebUI, and SSH. But when logging into the console the permissions for my own user that gives it privilege level 1 is not followed and allows the user to go into configuration terminal mode. On SSH and the WebUI this doesn't happen and is met with a "Authorization Error" as expected. Here is my configuration as I am quite puzzled why the console wouldn't listen to the privilege level set by NPS rules.
aaa new-model
!
!
aaa authentication login default group radius local
aaa authorization exec default group radius local
ip http server
ip http authentication aaa
ip http secure-server
ip forward-protocol nd
line con 0
stopbits 1
---Version---
Cisco IOS XE Software, Version 17.06.03
Cisco IOS Software [Bengaluru], IE3x00 Switch Software (IE3x00-UNIVERSALK9-M), Version 17.6.3, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2022 by Cisco Systems, Inc.
Compiled Wed 30-Mar-22 22:21 by mcpre
Cisco IOS-XE software, Copyright (c) 2005-2022 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.
ROM: IOS-XE ROMMON
BOOTLDR: Version 7.1.14 [RELEASE SOFTWARE] crashkernel=64M
switch2-ie3000 uptime is 15 hours, 44 minutes
Uptime for this control processor is 15 hours, 45 minutes
System returned to ROM by Reload Command at 20:14:06 UTC Thu Jun 6 2024
System image file is "flash:ie3x00-universalk9.17.06.03.SPA.bin"
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
Technology Package License Information:
------------------------------------------------------------------------------
Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------------------
network-essentials Smart License network-essentials
None Subscription Smart License None
Smart Licensing Status: Registration Not Applicable/Not Applicable
cisco IE-3300-8T2S (ARM) processor (revision V06) with 883739K/6147K bytes of memory.
Processor board ID FCW2743Y639
2 Virtual Ethernet interfaces
10 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
3952284K bytes of physical memory.
523264K bytes of crashinfo at crashinfo:.
1684480K bytes of Flash at flash:.
3883008K bytes of sdflash at sdflash:.
