ASR9k issue with tacacs+

[startx001]

Hi all ,

i have a issue with tacacs on ASR9k  with ACS 5.6  . ( other routers/ switches running IOS working with no issue ) 

Issue i that i can login to ASR9k , but authorization dont work . 

Only conf t command is working , nothing other , even i dont have one single comamnd in configure mode .

other , sh run dont show nothing , etc... 

Bellow is config from ASR 

tacacs source-interface MgmtEth0/RSP0/CPU0/0 vrf mgmt
tacacs-server host x.x.x.x port 49
aaa accounting exec TEST_list start-stop group TEST_tacacs
aaa accounting commands TEST_list start-stop group TEST_tacacs
aaa group server tacacs+ TEST_tacacs
vrf mgmt
server-private a.b.c.d port 49
  key 7 ( hidden ) 
aaa authorization exec TEST_list group TEST_tacacs local
aaa authorization commands TEST_list group TEST_tacacs none
aaa authentication login TEST_list group TEST_tacacs local

line default
login authentication TEST_list

Is config wrong ?

KR

VZ

[xthuijs]

hi VZ, yeah because you have named method lists, you also need to add the following command:

RP/0/RSP0/CPU0:A9K-BNG(config)#line default authorization exec TEST

cheers!

xander

[startx001]

Still same problem , when trying to issue show run it dont show nothing.

Command set on ACS is configured to permit show run .

KR

VZ

[xthuijs · Accepted solution]

can you provide me a :

show user task

and debug tacacs

  authentication  TACACS+ Authentication Debugging
  authorization   TACACS+ Authorization Debugging
  detail          More detailed TACACS+ AAA processing
  <cr>            

I suspect that you have no task group assigned to the user which causes the command to be permitted, but the taskgroup is not allowed to display anything from config, hence empty output.

you may need to add the taskgroup root-system for instance to the user profile.

xander

[startx001]

I think you right , 

How to do this to  the users on  tacacs 

KR

VZ

[xthuijs · Accepted solution]

hey vz,

for cli based tacacs an example would look like this:

service = exec {
    task = "#root-system"
}
 

in the ACS/gui you will need to browse to the box for the exec-service and in the text box add the "task=#root-system"

you need to relogin obviously with the user and you can verify the applied task group with the show user task.

oh, one other "tip". make sure there is a local user and local fallback etc because if the tacacs server is unavailable or the config on tacacs is incorrect we may lock ourselves out and the pw recovery is a tedious process for XR (as it should be i guess :).

see also here: https://supportforums.cisco.com/document/61306/asr9000xr-using-task-groups-and-understanding-priv-levels-and-authorization

I also added 2 pictures to visualize an ACS configuration (the priv level is optional, just there for completion in the picture)

cheers!

xander