Messed Up AAA Config on 3560g/3750g? (enable prompt)

[ram]

I've banged my head against the wall long enough.  I'm asking for help with what should be a very simple question for the gurus.  I am not, obviously.  I am using local authentication and was NOT receiving an enable prompt until a recent IOS (15.0.1 SE?) upgrade.  When one of my two users login, I would like to have them dropped into enable mode - not having to type a *different* enable password.

I'll attach a config w/ the particulars x'd out.

[ram]

Here are the applicable lines if you don't want to look @ the entire config:

username user1 privilege 15 secret 5 $1$uQjc$0oD5Sf9aDAQiz9wE8fuQE/
username user2 privilege 15 secret 5 $1$w45N$ZqKFwrLiTAGLBT9b7wQJg/
aa new-model
aaa authentication login default local
aaa authentication enable default enable
aaa authorization console
aaa authorization exec default local if-authenticated
aaa authorization commands 15 default local if-authenticated
aaa session-id common

[Collin Clark]

I don't have a device in front of me for verification, but under the VTY you add "privilege level 15".

[ram]

Wouldn't that give everyone who connects level 15 access?

Collin Clark wrote:
I don't have a device in front of me for verification, but under the VTY you add "privilege level 15".

[Collin Clark]

Sure will but w/o AAA it's either all or nothing (that I've ever seen).

[cadet alain]

Hi,

Robert Meredith a écrit:
 Wouldn't that give everyone who connects level 15 access?
Collin Clark wrote:
I don't have a device in front of me for verification, but under the VTY you add "privilege level 15".

Yes it will but as your users configured locally have privilege 15 it shouldn't be a problem imho.

Did you try without the authentication enable command?

gonna lab it up and tell you what.

edit: just labbed it on a 3600 router in GNS3 and with this it worked:

username user1  secret 5 $1$uQjc$0oD5Sf9aDAQiz9wE8fuQE/

username user2 privilege 15 secret 5 $1$w45N$ZqKFwrLiTAGLBT9b7wQJg/

aa new-model

aaa authentication login default local

aaa authorization console

user 1 is not in enable mode directly but user2 is.

Regards.

Alain.