"local" configuration in AAA

[wfqk]

Hi Below  is configuration for a router. The below authentication command can work well with its key work "local".

My question is the second "local" in authorization command can work well just based on the below configuration? Maybe we need to add some commands for it. 

username cisco1 privilege 15 password cisco

aaa authentication login default group tacacs+ local

aaa authorization exec default group tacacs+ local

[Richard Burts]

While I would expect local would be ok to provide a backup method for authorization I prefer to use if-authenticated to provide a backup method for aaa authorization.

HTH

Rick

[wfqk]

Thank you so much for your reply.

I think "local" for authentication command needs some command like the below command to work together:

Router(config)#username JUNIOR privilege 8 password CISCO

While "local" for authorization command needs some command like the below command to work together:

Router(config)#privilege exec level 8 configure terminal

If we are using "aaa authorization exec default group tacacs+ local" without "privilege exec level 8 configure terminal" , the "local" does not make sense.

Do you agree? 

[Richard Burts]

I do agree that for aaa authentication you need at least one user ID configured on the router. However I do not agree about aaa authorization needing user and privilege level. To understand this we need to be clear that while aaa authentication does one thing aaa authorization can do multiple things. In your original post you were configuring aaa authorization for exec (is a user authorized to establish a connection/exec session on the router). This does not require any other things to be configured. You can also use aaa authorization for commands at various privilege levels. For that you would need some additional commands to specify what a user should be authorized to do. 

HTH

Rick

[wfqk]

The "local" in aaa authentication login default group tacacs+ local refers to username and its password configured in the router.

The "local" in aaa authorization exec default group tacacs+ local refers to the same thing--username and its password configured in the router.? 

[Richard Burts]

Yes it refers to the same thing.

HTH

Rick