AutoCommand

Hello dears,
I m trying to configure the autocommand for jr engineer,that when he telnet to router he shld see the menu of selection,I m trying to configure according to book but it is not working. When the user login he is able to see the menu but when the user select the number for suppose 1 or 2 he gets an error invalid output,please find the attached.
Step 1.
Begin with the goal. In this situation, you have an administrator, that we call junior-admin, log in to a router via the Telnet protocol. This junior-admin is not allowed to make major changes to the router rbb. What you want to happen here is for junior-admin to see a menu when they authenticate to ACS, choose an option from that menu, and have authorization take place for those commands. Example 8-3 shows the configuration of the menu that is accessed by junior-admin upon accessing the command line of rbb.
Example 8-3. Menu Configuration
menu admin1 prompt ^C Please select an Action^C
menu admin1 text 1 Show IP Interface Brief
menu admin1 command 1 show ip interface brief
menu admin1 text 2 Show interface fa0/0
menu admin1 command 2 sh int fa0/0
menu admin1 text 3 Show Run Interface fa0/0
menu admin1 command 3 sh run int fa0/0
menu admin1 text 4 Show ip route
menu admin1 command 4 sh ip route
menu admin1 text 5 Show Arp
menu admin1 command 5 show arp
menu admin1 text 6 Clear the Arp table
menu admin1 command 6 clear arp
menu admin1 text 7 EXIT
menu admin1 command 7 logout
Step 2.
After this menu has been added to the router, you can test it by typing the following command: menu admin1.
Step 3.
Now that the menu is in place, you want to configure the TACACS+ settings on the router. Basic AAA commands are given in this example; however, for more detailed AAA configuration, see Appendix A, "RADIUS Attribute Tables." You now add the ACS server into the router.
Step 4.
Configure the AAA group and protocol by entering the command tacacs-server host 192.168.1.1.
Step 5.
Next, configure the secret key by entering the command tacacs-server key cooljive.
Step 6.
To enable authentication, enter the following AAA configuration command: aaa authentication login default group tacacs+ local.
To enable the autocommand, simply follow these steps:
Step 1.
Select TACACS+ in the Jump To list. By selecting TACACS+ in the Jump To list, you are taken to the TACACS+ Settings configuration screen
Step 2. From here, scroll to the Shell (exec) section. It is here that you enable the autocommand. You could enter any command here that you would like the user to execute. After the command has been executed, the Telnet connection to rbb drops.
Step 3. Now that you are in the Shell (exec) configuration section, you want to select the check box next to Shell (exec). This enables junior-admin shell authorization.
Step 4. Also, check the autocommand option and in the box, enter the command menu admin1. This was displayed in Figure 8-18.
Step 5. After the configuration is enabled, you can select Submit + Restart to restart the ACS service.
Step 6. Next, you Telnet from the junior-admin workstation where the junior-admin is prompted to enter a username and password. When authentication has been accepted, the autocommand takes place.

This is the Jabber Clients section of the forums, you probably want to move this to some other area that is related to your question...

Similar Messages

Autocommand not working

I cannot even see my customer connecting to the line,
router info
3845
IOS c3825-ipbasek9-mz.124-8c.bin
line 1/6
session-timeout 20
no exec-banner
exec-timeout 0 0
modem InOut
autocommand telnet 192.168.80.2 1389
terminal-type vt100
no exec
transport preferred telnet
transport input telnet
escape-character NONE
stopbits 1
flowcontrol software
3845#sh line 1/6
   Tty Line Typ     Tx/Rx    A Modem Roty AccO AccI Uses Noise Overruns Int
   1/6   72 TTY   9600/9600 - inout     -    -    -     0 39491    0/4      -
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600, no parity, 1 stopbits, 8 databits
Status: Ready, No Exit Banner, CTS Raised
Capabilities: EXEC Suppressed, Software Flowcontrol In,
Software Flowcontrol Out, Modem Callout, Modem RI is CD, No login banner
Modem state: Ready
Modem hardware state: CTS DSR DTR RTS
Special Chars: Escape Hold Stop Start Disconnect Activation
                none   none   ^S     ^Q      none
Timeouts:      Idle EXEC    Idle Session   Modem Answer Session   Dispatch
                never        00:20:00                       none     not set
                            Idle Session Disconnect Warning
                              never
                            Login-sequence User Response
                             00:00:30
                            Autoselect Initial Wait
                              not set
Modem type is unknown.
Session limit is not set.
Time since activation: 1w1d
Editing is enabled.
History is enabled, history size is 20.
DNS resolution in show commands is enabled
Full user help is disabled
Allowed input transports are telnet.
Allowed output transports are pad telnet rlogin lapb-ta mop v120 ssh.
Preferred transport is telnet.
Automatically execute command "telnet 192.168.80.2 1389"
No output characters are padded
No special data dispatching characters
any ideas?

Yes, I got the following answer from Mauricio Oviedo of TAC:
After reading the problem description included in your SR, I understand that
you are having issues setting automatic commands for SSH sessions.
The bug CSCdz17608 causes this problem on the Router. Here are the details:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fet
chBugDetails&bugId=CSCdz17608
When user logs into the router using ssh, autocommand is not executed when
using "login local" as in following config:
username autocommand
line vty 0 4
login local
transport ssh
Workaround:
Configure aaa instead of using login local.
Example:
aaa new-model
aaa authentication login VTYS local
aaa authorization exec VTYS local
line vty 0 4
login authentication VTYS
authorization exec VTYS
Please let me know how would you like me to proceed with this case and feel
free to contact me if you have any question or doubt.
Best regards,
Mauricio Oviedo
SMB Team
Cisco Support Engineer
Email: [email protected]
Phone: 407 241-2965 x4682
Monday through Friday 8:00 a.m. - 5:00 p.m. CDT
I verified that the fix works.

Autocommand line command not working

I am trying to use the aux interface on one router to communicate with the aux interface on another router. Connected to each aux interface is a vt100 type terminal. I have autocommand telnet 60.20.70.6 2004 configured on one router's line 4 interface and on the other routers line 4 interface I accept all connections. My understanding is that when I type / send data to the async port on the router with the autocommand, a telent session should start creating a raw tunnel between the 2 async ports. The routers have no problems with telnetting from a command line to the async on the other router. I just can't get the autocommand to work. Any suggestions?

Please post your question to "Remote Access" under "Network Infrastructure." You will find a better expertise there. This section is mainly for SNA over Cisco routers.

Line has invalid autocommand " ppp negotiate"

Hi all,
i am trying to deploy radius authentication on my switches.
aaa authentication login default group radius local
aaa authorization exec default group radius local
I think that these two command is everythink what i need for radius authentication and authorization.
But when i try to login i get error message:
Line has invalid autocommand " ppp negotiate"
Please could you help me? I try to use command
line vty 0 15
no autocommand ppp negotiate
but with no success.
Please i need you urgent help.
Thanks a lot
Tomas

Hi igambhir,
thank very much, i remove service-type and framed-protocol from radius, and that error message doesn't appear again.
But new problem arised for me :)
Authorization failed
But i don't know why?
I have command
aaa authorization exec default group radius
and i expect that when i am able to authenticate on radius i will be able to authorized also.
It is needed to set somethning on microsoft radius server?
Thanks in advance
Tomas

High CPU with "autocommand telnet..."

I used the "autocommand telnet..." function to allow two async devices to communicate via a pair of 3640 routers. The routers have 32-port async modules installed for this solution. I have found that once a single connection establishes between the routers, the source router CPU jumps by about 17% while the destination router CPU jumps about 22%. Does anyone know if this is normal or if there is a way to reduce the jump in CPU?

The best option to fix the issue is to enable CEF.Using CEF will allow the router to process traffic in the most efficient way possible.

Using CLI to enter Mac local list on 1200 Series

I have a number of 1200 series Ap's that are set up for MAC Authentication based on a local list only. From the GUI these addresses are entered from the Advanced Security Screen.
I wnt to find a method for entering them from the CLI but am running into a problem with the level 7 passwords that seem to be automaticly applied when the MAC addresses are added from the GUI.
If I enter MAC 0011.22aa.33ff from the GUI and then look at the config from the CLI it looks like this:
username xxx password xxxx
username xxxx autocommand exit
how do I do this from the CLI?

Hi,
I think if you need to enter lots of MAC Addresses into AP, the fastest way is to use CLI.
Refer to the following doc on how to configure MAC from CLI. Look under "Local Authenticator Access Point - Step 11"
http://www.cisco.com/en/US/partner/products/hw/wireless/ps4570/products_configuration_guide_chapter09186a0080341e72.html#wp1039558
If authentication is purely done via MAC, then you can do like the following example:
AP#config t
AP(config-radsrv)# user xxx password xxx group clerks mac-auth-only
Probably you need to use notepad to list all MAC (as username & password), then copy &paste to your AP's CLI.
Hope this helps.
Rgds,
AK

I want to see both the ssid in same time

help in aironet 1200
i hope to help me,
i have created two ssid with two vlan's but the broadcast is for one ssid only, i want the broadcasting for all my ssid in same time. where that the one ssid be appeared and other one be a hiden.
so how can i do that?
I want to see both the ssid in same time
EXD-AP#
EXD-AP#sh run
Building configuration...
Current configuration : 4617 bytes
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname EXD-AP
ip subnet-zero
ip domain name Schoch-home.com
ip name-server 172.16.0.3
aaa new-model
aaa group server radius rad_eap
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa authentication login default local
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 vlan-name test vlan 1
dot11 ssid EXDINT
   vlan 30
   authentication open
   authentication key-management wpa
   guest-mode
   infrastructure-ssid
   wpa-psk ascii 7 14120A0F410D243F04796166
dot11 ssid GUEST
   vlan 20
   authentication open
   authentication key-management wpa
   wpa-psk ascii 7 13000F1646050A3E0B777A62
username 78e400ed9588 password 7 06515724181E591C014E475354
username 78e400ed9588 autocommand exit
username 001e65ee5c38 password 7 135547430E5A512F2E712B606D
username 001e65ee5c38 autocommand exit
username 002668ec5b49 password 7 144742595A52722E277D31617B
username 002668ec5b49 autocommand exit
username 0022fc5b437b password 7 15425B5E562C28712A67667511
username 0022fc5b437b autocommand exit
username 00234d9fa256 password 7 075F711E1D5D1D5C1113595952
username 00234d9fa256 autocommand exit
username iqbal privilege 15 password 7 00010B02240A5955
username c417fea872a3 password 7 04585F575827494F514E571641
username c417fea872a3 autocommand exit
username 0016cf264d57 password 7 040B5B5759224A1C5F4D014245
username 0016cf264d57 autocommand exit
username exd-hq privilege 15 password 7 00010B02240A5955
username 00268202706b password 7 15425B5E527279747A64657411
username 00268202706b autocommand exit
username 002314054ea0 password 7 091C1E5B4A5443425E58012B7B
username 002314054ea0 autocommand exit
username 002436e8f6ca password 7 1249554546585A01722D722B32
username 002436e8f6ca autocommand exit
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers tkip
encryption vlan 30 mode ciphers tkip
encryption vlan 20 mode ciphers tkip
ssid EXDINT
ssid GUEST
speed basic-1.0 basic-2.0 basic-5.5 basic-11.0
station-role root
interface Dot11Radio0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 subscriber-loop-control
bridge-group 20 block-unknown-source
no bridge-group 20 source-learning
no bridge-group 20 unicast-flooding
bridge-group 20 spanning-disabled
interface Dot11Radio0.30
encapsulation dot1Q 30 native
no ip route-cache
bridge-group 1
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
encryption mode ciphers tkip
speed basic-6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
interface Dot11Radio1.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 subscriber-loop-control
bridge-group 20 block-unknown-source
no bridge-group 20 source-learning
no bridge-group 20 unicast-flooding
bridge-group 20 spanning-disabled
interface Dot11Radio1.30
encapsulation dot1Q 30 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
ip address 192.168.30.10 255.255.255.0
no ip route-cache
duplex auto
speed auto
hold-queue 160 in
interface FastEthernet0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
no bridge-group 20 source-learning
bridge-group 20 spanning-disabled
interface FastEthernet0.30
encapsulation dot1Q 30 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface BVI1
ip address 192.168.30.10 255.255.255.0
no ip route-cache
ip default-gateway 192.168.30.1
ip http server
ip http authentication aaa
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server attribute 32 include-in-access-req format %h
radius-server vsa send accounting
control-plane
bridge 1 route ip
line con 0
line vty 0 4
end
EXD-AP#
EXD-AP#
EXD-AP#

I think that my AP not support the MBSSID doue to it's very old , can update it ? if i can that how i do that?
System Software Version: Cisco IOS Software
Product/Model Number:
AIR-AP1210
Top Assembly Serial Number:
FHK0712J02R
System Software Filename:
c1200-k9w7-tar.123-8.JEA3
System Software Version:
12.3(8)JEA3
Bootloader Version:
12.2(8)JA
System Uptime:
3 days, 32 minutes

Vim reasonable defaults for all users.

now the vim package keeps a less-than-minimal set of default settings. So keeping the old default as starting point I made what I think is a reasonable default:
" Use Vim settings, rather then Vi settings (much better!).
" This must be first, because it changes other options as a side effect.
set nocompatible
" allow backspacing over everything in insert mode
set backspace=indent,eol,start
set history=50 " keep 50 lines of command line history
set ruler " show the cursor position all the time
set showcmd " display incomplete commands
set incsearch " do incremental searching
set listchars=tab:˛\ ,trail:┈ " show trail spaces and tabs
set list
set wildmode=list:longest,full " use the new menus
set wildmenu
set background=dark " who uses white terminals anyway?
"statusline: filename, filetype, mod, rw, help, preview,
set statusline=%t\ %y\ %m%r%h%w
"statusline: separation between lef and right aligned items
set statusline+=%=
"statusline: lines number, column number, percent
set statusline+=[L:\ %l/%L]\ [C:\ %v]\ [%p%%]
set laststatus=2 " always show status line
set highlight+=sn
" Don't use Ex mode, use Q for formatting
map Q gq
" Use space and backspace to scroll the document
map <space> <c-d>
map <bs> <c-u>
" Disable f1, if you need help use `:help'
map <f1> <nop>
map ; :
" CTRL-U in insert mode deletes a lot. Use CTRL-G u to first break undo,
" so that you can undo CTRL-U after inserting a line break.
inoremap <C-U> <C-G>u<C-U>
" In many terminal emulators the mouse works just fine, thus enable it.
if has('mouse')
set mouse=a
endif
" Switch syntax highlighting on, when the terminal has colors
" Also switch on highlighting the last used search pattern.
if &t_Co > 2 || has("gui_running")
syntax on
set hlsearch
endif
" Only do this part when compiled with support for autocommands.
if has("autocmd")
" Enable file type detection.
" Use the default filetype settings, so that mail gets 'tw' set to 72,
" 'cindent' is on in C files, etc.
" Also load indent files, to automatically do language-dependent indenting.
filetype plugin indent on
" Put these in an autocmd group, so that we can delete them easily.
augroup vimrcEx
au!
" For all text files set 'textwidth' to 78 characters.
autocmd FileType text setlocal textwidth=78
" When editing a file, always jump to the last known cursor position.
" Don't do it when the position is invalid or when inside an event handler
" (happens when dropping a file on gvim).
" Also don't do it when the mark is in the first line, that is the default
" position when opening a file.
autocmd BufReadPost *
\ if line("'\"") > 1 && line("'\"") <= line("$") |
\ exe "normal! g`\"" |
\ endif
augroup END
else
set autoindent " always set autoindenting on
endif " has("autocmd")
" Convenient command to see the difference between the current buffer and the
" file it was loaded from, thus the changes you made.
" Only define it when not defined already.
if !exists(":DiffOrig")
command DiffOrig vert new | set bt=nofile | r # | 0d_ | diffthis
\ | wincmd p | diffthis
endif
I put it here hoping it helps you or yours users' vim experience. Please leave any comment.
Last edited by ezzetabi (2009-09-30 13:53:47)

Hi, I think this is not a bad idea. I do like using listchars to show tabs and trailing spaces like that, but I think that using commoly used characters like _ is confusing. If you go into vim and use the :digraph command you can see lots of special characters which are useful IMO for listchars. I use set listchars=tab:→,trail:¸, but I don't know if they'd be best for everyone. But I think it is clearer than using normal keyboard characters.

PRI + PVDM modems - set IP destination based on DNIS

I have the following setup:
2811 router
PVDM2-12DM modem module on motherboard
NM-1CE1T1-PRI PRI card
The PRI has a range of numbers assigned to it, but I need to be able to direct dial-in traffic to specific backend IP addresses, based on the number the user dials in to reach the router (the DNIS). I am familiar with the autocommand function used in line configs and have used it before with asynch attached modems to trigger telnet sessions, but never with PRI. Is it possible?
Can anyone provide some links to documetnation or advice on how to set this up?
thanks very much.

Thanks for the link, its a great help! However I am unable to configure a modem-pool. In global config mode "modem-pool" is an unrecognised command. There is no problem with the modems as the router recognises the PVDM2 modem bank when I show diagnostics.
When issuing 'sh line' I can also see the 12 modem lines 0/322 - 0/333. They also show up automatically as 12 individual asynch interfaces in the config.
Im running IOS 12.4(9)T4
Could it be there is alternative config required for these types of modems?
Thanks again,

Two problems with EEM script

I have an EEM script (below) and I have two problems.
1) Line action 4.5 gets a "%Error opening bootdisk:blackhole (File or Directory already in use)"
2) Line 5.0 - 5.5 get "Line has invalid autocommand "sh mls cef hardware module 4 | append sup-bootdisk:blackhole"
Any ideas to get me on my way?
thanks!
jim

I'm guessing you'd get the same errors if you ran these commands manually in this order one after other (i.e., you pasted them into the CLI). This might just be a limitation of the file system. What you might do is conver this to Tcl so you don't need to use the CLI to store the output (or at least open the file once).
You can use the tool at http://www.marcuscom.com/convert_applet/ to convert your applet to Tcl. A simple modification would then be to remove the append bits, and store the $_cli_result into an accumulator buffer. At the end, do the email of that buffer.

Privilege Levels on FWs, switches and Routers

One question - I am bothered with the privilege level settings.
Is there a default mapping between a priv lvl and teh commands you are allowed to execute or one needs to define that.
EX: I want somebody to only have the right of executing sh run on a device and nothing more.Can this be done?
Thx,
Vlad

I would start by configuring a privilege level and then use the ? to list all the commands available at that level.
privilege level 0 - Includes the disable, enable, exit, help, and logout commands.
privilege level 1 - Normal level on Telnet; includes all user-level commands at the router> prompt.
privilege level 15 - Includes all enable-level commands at the router# prompt.
Commands available at a particular level in a particular router can be found by typing a ? at the router prompt. Commands may be moved between privilege levels by using the privilege command, as illustrated in the example. While this example shows local authentication and authorization, the commands work similarly for TACACS+ or RADIUS authentication and exec authorization (more granularity in control of the router may be achieved with implementation of TACACS+ command authorization with a server.)
Additional details on the users and privilege levels presented in the example:
User six is able to Telnet in and execute the show run command, but the resulting configuration is virtually blank because this user cannot configure anything (configure terminal is at level 8, not at level 6). The user is not permitted to see usernames and passwords of the other users, or to see Simple Network Management Protocol (SNMP) information.
User john is able to Telnet in and execute the show run command, but only sees commands that he can configure (the snmp-server community part of the router configuration, since this user is our network management administrator). He can configure snmp-server community because configure terminal is at level 8 (at or below level 9), and snmp-server community is a level 8 command. The user is not permitted to see usernames and passwords of the other users, but he is trusted with the SNMP configuration.
User inout is able to Telnet in, and, by virtue of being configured for autocommand show running, sees the configuration displayed but is disconnected thereafter.
User poweruser is able to to Telnet in and execute the show run command. This user is at level 15, and is able to see all commands. All commands are at or below level 15; users at this level can also view and control usernames and passwords.
HTH

Problem with RSH access on 7204-G2

Hi
I want to "add" "delete" lines in dynamic access-list by RSH from Linux.
I can only delete lines from access-list,but when I add lines I receive message:
"Line has invalid autocommand "access-template 105 test1 host 192.168.3.246 any
Here my script:
#!/bin/bash
rsh -l voip 192.168.55.49 access-template 105 test1 host 192.168.3.246 any
rsh -l voip 192.168.55.49 clear access-template 105 test1 host 192.168.3.246 any
Here my config:
Cisco IOS Software, 7200 Software (C7200P-ADVENTERPRISEK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2)
no ip domain lookup
ip rcmd rcp-enable
ip rcmd rsh-enable
ip rcmd remote-host voip 192.168.3.246 rsh enable

Here some logs:
From Linux server:
[root@Scripts]# ./auto_acl.sh
Line has invalid autocommand "access-template 105 test1 host 192.168.3.246 any"
[root@Scripts]# ./auto_acl.sh
Line has invalid autocommand "access-template 105 test1 host 192.168.3.246 any"
[root@Scripts]# ./auto_acl.sh
Line has invalid autocommand "access-template 105 test1 host 192.168.3.246 any"
[root@Scripts]#
From 7204:
Nov 22 14:17:28.782: RCMD: [514 <- 192.168.255.247:1023] recv 1022\0
Nov 22 14:17:28.982: RCMD: [514 <- 192.168.255.247:1023] recv root\0voip\0access-template 105 test1 host 192.168.3.246 any\0
Nov 22 14:17:28.982: RCMD: [514 -> 192.168.255.247:1023] send
Nov 22 14:18:04.968: RCMD: [514 <- 192.168.255.247:1023] recv 1022\0
Nov 22 14:18:05.168: RCMD: [514 <- 192.168.255.247:1023] recv root\0voip\0access-template 105 test1 host 192.168.3.246 any\0
Nov 22 14:18:05.168: RCMD: [514 -> 192.168.255.247:1023] send
Nov 22 14:18:10.376: RCMD: [514 <- 192.168.255.247:1023] recv 1022\0
Nov 22 14:18:10.576: RCMD: [514 <- 192.168.255.247:1023] recv root\0voip\0access-template 105 test1 host 192.168.3.246 any\0
Nov 22 14:18:10.576: RCMD: [514 -> 192.168.255.247:1023] send
7204#

2611xm Terminal Server + ACS + reauthentication when selecting menu options

Hi,
I've managed to setup ACS Authentication on my 2611xm router,
after you login to the router I have a autocommand setup to run a menu.
My problem is when you select the option on the menu,
You are then re prompted to reauthenicated against the router again before connecting to the line,
can any one tell me how to stop this from happening.
Thanks for your time and effort in advance, I have enclosed a config below.
DDRAS01#sh running-config
Building configuration...
Current configuration : 6854 bytes
! Last configuration change at 10:28:49 AEST Sun Feb 21 2010 by <removed>
! NVRAM config last updated at 19:25:53 AEST Sat Feb 20 2010 by <removed>
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service linenumber
service sequence-numbers
hostname DDRAS01
boot-start-marker
boot-end-marker
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 informational
logging rate-limit all 10000
logging console critical
enable password 7 <removed>
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login if_needed local
aaa authentication enable default enable
aaa authentication ppp default local
aaa authorization exec default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common
clock timezone AEST 10
clock summer-time AEST recurring last Sun Oct 2:00 last Sun Mar 3:00
no network-clock-participate slot 1
no network-clock-participate wic 0
ip cef
ip domain list <removed>
ip domain list <removed>
ip domain name <removed>
ip host dd-cr-01e 2033 172.16.1.1
ip host ddsws01 2034 172.16.1.1
ip host ddsws04 2035 172.16.1.1
ip host ddce565 2040 172.16.1.1
ip name-server <removed>
ip name-server <removed>
username netops privilege 15 password 7 <removed>
ip ssh source-interface FastEthernet0/0
ip ssh logging events
ip ssh version 2
interface Loopback0
ip address 172.16.1.1 255.255.255.255
interface FastEthernet0/0
ip address <removed> 255.255.255.0
speed 100
full-duplex
interface Serial0/0
no ip address
shutdown
interface BRI0/0
no ip address
encapsulation hdlc
shutdown
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 <removed>
ip http server
no ip http secure-server
ip tacacs source-interface FastEthernet0/0
ip radius source-interface FastEthernet0/0
logging facility local6
logging <removed>
snmp-server community <removed> RO
snmp-server community <removed> RW
snmp-server location <removed>
snmp-server contact NetOps
menu ddras01 title ^C
Cisco Terminal Server
Select the number from the list below
Use 'ctrl+shift+6' then 'x' to switch back to the menu
^C
menu ddras01 text 1 Connect to DD-CR-01
menu ddras01 command 1 resume dd-cr-01 /connect telnet dd-cr-01 2033
menu ddras01 text 2 Connect to DDSWS01
menu ddras01 command 2 resume ddsws01 /connect telnet ddsws01 2034
menu ddras01 text 3 Connect to DDSWS04
menu ddras01 command 3 resume ddsws04 /connect telnet ddsws04 2035
menu ddras01 text 8 Connect to DDCE565
menu ddras01 command 8 resume ddce565 /connect telnet ddce565 2040
menu ddras01 text 9 Exit
menu ddras01 command 9 menu-exit
menu ddras01 clear-screen
menu ddras01 status-line
menu ddras01 line-mode
tacacs-server host 10.2.0.50
tacacs-server directed-request
tacacs-server key 7 <removed>
control-plane
privilege exec level 15 write terminal
privilege exec level 15 write
privilege exec level 1 ping
privilege exec level 10 undebug ip icmp
privilege exec level 10 undebug ip
privilege exec level 10 undebug all
privilege exec level 10 undebug
privilege exec level 10 terminal monitor
privilege exec level 10 terminal
privilege exec level 15 show running-config
privilege exec level 5 show configuration
privilege exec level 5 show
privilege exec level 10 debug ip icmp
privilege exec level 10 debug ip
privilege exec level 10 debug all
privilege exec level 10 debug
privilege exec level 10 clear interface
privilege exec level 10 clear counters
privilege exec level 10 clear
line con 0
password 7 <removed>
logging synchronous
line 33 64
no exec-banner
exec-timeout 0 0
no activation-character
no exec
transport preferred telnet
transport input all
escape-character 27
stopbits 1
flowcontrol hardware
line aux 0
line vty 0 4
password 7 <removed>
logging synchronous
autocommand menu ddras01
line vty 5 181
password 7 <removed>
logging synchronous
autocommand menu ddras01
ntp clock-period 17208487
ntp source FastEthernet0/0
ntp server <removed>
end

Hi Jesse
I have made the changes you recommended however i'm still getting prompted to reauthenticate each time I choose a menu entry,
I have included a updated copy of the config, any help you can provide if greatly appreaciated.
Thanks
DDRAS01(config)#do sh runnin
Building configuration...
Current configuration : 7371 bytes
! Last configuration change at 17:55:22 AEST Sun Feb 21 2010 by david
! NVRAM config last updated at 11:07:30 AEST Sun Feb 21 2010 by david
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service linenumber
service sequence-numbers
hostname DDRAS01
boot-start-marker
boot-end-marker
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 informational
logging rate-limit all 10000
logging console critical
enable password 7
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login if_needed local
aaa authentication login NOAUTH none
aaa authentication enable default enable
aaa authentication ppp default local
aaa authorization exec default group tacacs+ local if-authenticated
aaa authorization exec NOAUTH none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common
clock timezone AEST 10
clock summer-time AEST recurring last Sun Oct 2:00 last Sun Mar 3:00
no network-clock-participate slot 1
no network-clock-participate wic 0
ip cef
ip domain list
ip domain list
ip domain name
ip host dd-cr-01 2033 172.16.1.1
ip host ddsws01 2034 172.16.1.1
ip host ddsws04 2035 172.16.1.1
ip host ddce565 2040 172.16.1.1
ip name-server
ip name-server
username netops privilege 15 password 7
ip ssh source-interface FastEthernet0/0
ip ssh logging events
ip ssh version 2
interface Loopback0
ip address 172.16.1.1 255.255.255.255
interface FastEthernet0/0
ip address 255.255.255.0
speed 100
full-duplex
interface Serial0/0
no ip address
shutdown
interface BRI0/0
no ip address
encapsulation hdlc
shutdown
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0
ip http server
no ip http secure-server
ip tacacs source-interface FastEthernet0/0
ip radius source-interface FastEthernet0/0
logging facility local6
logging
snmp-server community RO
snmp-server community RW
snmp-server location
snmp-server contact
menu ddras01 title ^C
Cisco Terminal Server
Select the number from the list below
Use 'ctrl+shift+6' then 'x' to switch back to the menu
^C
menu ddras01 text 1 Connect to DD-CR-01
menu ddras01 command 1 resume dd-cr-01 /connect telnet dd-cr-01 2033
menu ddras01 text 2 Connect to DDSWS01
menu ddras01 command 2 resume ddsws01 /connect telnet ddsws01 2034
menu ddras01 text 3 Connect to DDSWS04
menu ddras01 command 3 resume ddsws04 /connect telnet ddsws04 2035
menu ddras01 text 8 Connect to DDCE565
menu ddras01 command 8 resume ddce565 /connect telnet ddce565 2040
menu ddras01 text a Clear connection to DD-CR-01
menu ddras01 command a clear line 33
menu ddras01 text b Clear connection to DDSWS01
menu ddras01 command b clear line 34
menu ddras01 text c Clear connection to DDSWS04
menu ddras01 command c clear line 35
menu ddras01 text h Clear connection to DDCE565
menu ddras01 command h clear line 40
menu ddras01 text x Exit Menu
menu ddras01 command x menu-exit
menu ddras01 text l Logout
menu ddras01 command l logout
menu ddras01 clear-screen
menu ddras01 status-line
tacacs-server host
tacacs-server directed-request
tacacs-server key 7
control-plane
privilege exec level 15 write terminal
privilege exec level 15 write
privilege exec level 1 ping
privilege exec level 10 undebug ip icmp
privilege exec level 10 undebug ip
privilege exec level 10 undebug all
privilege exec level 10 undebug
privilege exec level 10 terminal monitor
privilege exec level 10 terminal
privilege exec level 15 show running-config
privilege exec level 5 show configuration
privilege exec level 5 show
privilege exec level 10 debug ip icmp
privilege exec level 10 debug ip
privilege exec level 10 debug all
privilege exec level 10 debug
privilege exec level 10 clear interface
privilege exec level 10 clear counters
privilege exec level 10 clear
line con 0
password 7
logging synchronous
line 33 64
no exec-banner
exec-timeout 0 0
no activation-character
no exec
transport preferred telnet
transport input all
escape-character 27
stopbits 1
flowcontrol hardware
line aux 0
line vty 0 4
password 7
logging synchronous
autocommand menu ddras01
line vty 5 181
password 7
authorization exec NOAUTH
logging synchronous
login authentication NOAUTH
autocommand menu ddras01
ntp clock-period 17208478
ntp source FastEthernet0/0
ntp server
end

2611xm Terminal Server + ACS + duplicate login when using menu options

Hi,
I'm trying to set up ACS on my 2611xm router, so far I have been able to do this, however when you login,
I have a autocommand setup to run a menu. My problem is when you select the option on the menu it
reauthenicated against the router again before connecting to the line, can any one tell me how to stop this from happening.
Thanks for your time and effort in advance, I have enclosed a config below.
DDRAS01#sh running-config
Building configuration...
Current configuration : 6854 bytes
! Last configuration change at 10:28:49 AEST Sun Feb 21 2010 by <removed>
! NVRAM config last updated at 19:25:53 AEST Sat Feb 20 2010 by <removed>
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service linenumber
service sequence-numbers
hostname DDRAS01
boot-start-marker
boot-end-marker
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 informational
logging rate-limit all 10000
logging console critical
enable password 7 <removed>
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login if_needed local
aaa authentication enable default enable
aaa authentication ppp default local
aaa authorization exec default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common
clock timezone AEST 10
clock summer-time AEST recurring last Sun Oct 2:00 last Sun Mar 3:00
no network-clock-participate slot 1
no network-clock-participate wic 0
ip cef
ip domain list <removed>
ip domain list <removed>
ip domain name <removed>
ip host dd-cr-01e 2033 172.16.1.1
ip host ddsws01 2034 172.16.1.1
ip host ddsws04 2035 172.16.1.1
ip host ddce565 2040 172.16.1.1
ip name-server <removed>
ip name-server <removed>
username netops privilege 15 password 7 <removed>
ip ssh source-interface FastEthernet0/0
ip ssh logging events
ip ssh version 2
interface Loopback0
ip address 172.16.1.1 255.255.255.255
interface FastEthernet0/0
ip address <removed> 255.255.255.0
speed 100
full-duplex
interface Serial0/0
no ip address
shutdown
interface BRI0/0
no ip address
encapsulation hdlc
shutdown
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 <removed>
ip http server
no ip http secure-server
ip tacacs source-interface FastEthernet0/0
ip radius source-interface FastEthernet0/0
logging facility local6
logging <removed>
snmp-server community <removed> RO
snmp-server community <removed> RW
snmp-server location <removed>
snmp-server contact NetOps
menu ddras01 title ^C
Cisco Terminal Server
Select the number from the list below
Use 'ctrl+shift+6' then 'x' to switch back to the menu
^C
menu ddras01 text 1 Connect to DD-CR-01
menu ddras01 command 1 resume dd-cr-01 /connect telnet dd-cr-01 2033
menu ddras01 text 2 Connect to DDSWS01
menu ddras01 command 2 resume ddsws01 /connect telnet ddsws01 2034
menu ddras01 text 3 Connect to DDSWS04
menu ddras01 command 3 resume ddsws04 /connect telnet ddsws04 2035
menu ddras01 text 8 Connect to DDCE565
menu ddras01 command 8 resume ddce565 /connect telnet ddce565 2040
menu ddras01 text 9 Exit
menu ddras01 command 9 menu-exit
menu ddras01 clear-screen
menu ddras01 status-line
menu ddras01 line-mode
tacacs-server host 10.2.0.50
tacacs-server directed-request
tacacs-server key 7 <removed>
control-plane
privilege exec level 15 write terminal
privilege exec level 15 write
privilege exec level 1 ping
privilege exec level 10 undebug ip icmp
privilege exec level 10 undebug ip
privilege exec level 10 undebug all
privilege exec level 10 undebug
privilege exec level 10 terminal monitor
privilege exec level 10 terminal
privilege exec level 15 show running-config
privilege exec level 5 show configuration
privilege exec level 5 show
privilege exec level 10 debug ip icmp
privilege exec level 10 debug ip
privilege exec level 10 debug all
privilege exec level 10 debug
privilege exec level 10 clear interface
privilege exec level 10 clear counters
privilege exec level 10 clear
line con 0
password 7 <removed>
logging synchronous
line 33 64
no exec-banner
exec-timeout 0 0
no activation-character
no exec
transport preferred telnet
transport input all
escape-character 27
stopbits 1
flowcontrol hardware
line aux 0
line vty 0 4
password 7 <removed>
logging synchronous
autocommand menu ddras01
line vty 5 181
password 7 <removed>
logging synchronous
autocommand menu ddras01
ntp clock-period 17208487
ntp source FastEthernet0/0
ntp server <removed>
end

Hi,
I'm trying to set up ACS on my 2611xm router, so far I have been able to do this, however when you login,
I have a autocommand setup to run a menu. My problem is when you select the option on the menu it
reauthenicated against the router again before connecting to the line, can any one tell me how to stop this from happening.
Thanks for your time and effort in advance, I have enclosed a config below.
DDRAS01#sh running-config
Building configuration...
Current configuration : 6854 bytes
! Last configuration change at 10:28:49 AEST Sun Feb 21 2010 by <removed>
! NVRAM config last updated at 19:25:53 AEST Sat Feb 20 2010 by <removed>
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service linenumber
service sequence-numbers
hostname DDRAS01
boot-start-marker
boot-end-marker
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 informational
logging rate-limit all 10000
logging console critical
enable password 7 <removed>
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login if_needed local
aaa authentication enable default enable
aaa authentication ppp default local
aaa authorization exec default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common
clock timezone AEST 10
clock summer-time AEST recurring last Sun Oct 2:00 last Sun Mar 3:00
no network-clock-participate slot 1
no network-clock-participate wic 0
ip cef
ip domain list <removed>
ip domain list <removed>
ip domain name <removed>
ip host dd-cr-01e 2033 172.16.1.1
ip host ddsws01 2034 172.16.1.1
ip host ddsws04 2035 172.16.1.1
ip host ddce565 2040 172.16.1.1
ip name-server <removed>
ip name-server <removed>
username netops privilege 15 password 7 <removed>
ip ssh source-interface FastEthernet0/0
ip ssh logging events
ip ssh version 2
interface Loopback0
ip address 172.16.1.1 255.255.255.255
interface FastEthernet0/0
ip address <removed> 255.255.255.0
speed 100
full-duplex
interface Serial0/0
no ip address
shutdown
interface BRI0/0
no ip address
encapsulation hdlc
shutdown
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 <removed>
ip http server
no ip http secure-server
ip tacacs source-interface FastEthernet0/0
ip radius source-interface FastEthernet0/0
logging facility local6
logging <removed>
snmp-server community <removed> RO
snmp-server community <removed> RW
snmp-server location <removed>
snmp-server contact NetOps
menu ddras01 title ^C
Cisco Terminal Server
Select the number from the list below
Use 'ctrl+shift+6' then 'x' to switch back to the menu
^C
menu ddras01 text 1 Connect to DD-CR-01
menu ddras01 command 1 resume dd-cr-01 /connect telnet dd-cr-01 2033
menu ddras01 text 2 Connect to DDSWS01
menu ddras01 command 2 resume ddsws01 /connect telnet ddsws01 2034
menu ddras01 text 3 Connect to DDSWS04
menu ddras01 command 3 resume ddsws04 /connect telnet ddsws04 2035
menu ddras01 text 8 Connect to DDCE565
menu ddras01 command 8 resume ddce565 /connect telnet ddce565 2040
menu ddras01 text 9 Exit
menu ddras01 command 9 menu-exit
menu ddras01 clear-screen
menu ddras01 status-line
menu ddras01 line-mode
tacacs-server host 10.2.0.50
tacacs-server directed-request
tacacs-server key 7 <removed>
control-plane
privilege exec level 15 write terminal
privilege exec level 15 write
privilege exec level 1 ping
privilege exec level 10 undebug ip icmp
privilege exec level 10 undebug ip
privilege exec level 10 undebug all
privilege exec level 10 undebug
privilege exec level 10 terminal monitor
privilege exec level 10 terminal
privilege exec level 15 show running-config
privilege exec level 5 show configuration
privilege exec level 5 show
privilege exec level 10 debug ip icmp
privilege exec level 10 debug ip
privilege exec level 10 debug all
privilege exec level 10 debug
privilege exec level 10 clear interface
privilege exec level 10 clear counters
privilege exec level 10 clear
line con 0
password 7 <removed>
logging synchronous
line 33 64
no exec-banner
exec-timeout 0 0
no activation-character
no exec
transport preferred telnet
transport input all
escape-character 27
stopbits 1
flowcontrol hardware
line aux 0
line vty 0 4
password 7 <removed>
logging synchronous
autocommand menu ddras01
line vty 5 181
password 7 <removed>
logging synchronous
autocommand menu ddras01
ntp clock-period 17208487
ntp source FastEthernet0/0
ntp server <removed>
end

FAC in CME 9.1

Hello ,
I need a help in configuring FAC for international calls in CME 9.1, I m following the below link but i am confused for the configuration text highlighted below.
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucme/admin/configuration/guide/cmeadm/cmefac.html
voice lpcor enable
voice lpcor custom
group 11 LocalUser
group 12 AnalogPhone
voice lpcor policy LocalUser
service fac
accept LocalUser fac
accept AnalogPhone fac
voice lpcor policy AnalogPhone
service fac
accept LocalUser fac
accept AnalogPhone fac
application
package auth
param passwd-prompt flash:en_bacd_welcome.au -----from where i will get this files ??
param passwd 54321
param user-prompt flash:en_bacd_enter_dest.au-----from where i will get this files ???
param term-digit #
param abort-digit *
param max-digits 32
thanks

Hi,
the FAC in CME is a bit tricky.
FAC call flow in CME like follow
1) IP Phone user dials a particular pattern (international destination, for example)
2) If this destination is enabled for FAC, the user will hear a voice prompt asking for an Account number and PIN
3) The user enters the Account/PIN pair. If valid, the call proceeds, if not the call is dropped.
- If the authentication fails after three retries, the call drops without notification.
Configuration Steps:
1- upload "enter_account.au" and "enter_pin.au" to the flash files. you can record these files.
2- Enter the following commands in configuration mode (in this example the Account and PIN are three digits long). This forces a user id and pid length, but it not required:
application
service clid_authen_collect
param uid-len 3              *length id 3 characters (can be user ext)
param pin-len 3              *length pin 3 characters
3- Create usernames for authentication. Notice that the username/password will represent the Account and PIN that the caller will have to dial to be successfully authenticated. You can create multiple usernames and then hand those out to select personnel that will be allowed to place premium calls. In this example both Account and PIN are three digits long.
aaa new-model
aaa authentication login h323 local
aaa authorization exec h323 local and network authorization
aaa authorization network h323 local for h323
username 107 password 123
username 107 autocommand exit
4- Create dial-peer cor
voice lpcor custom
group 1 manager
group 2 users
voice lpcor policy manager
service fac
accept manager fac
accept users fac
dial-peer cor custom
name international
  name fac-int
name user-fac
dial-peer cor list int
member international
dial-peer cor list fac-int
member fac-int
dial-peer cor list user-fac
member user-fac
5- Create a dial-peer for each pattern that you want cover using this application.
dial-peer voice 400 voip
corlist incoming fac-int
corlist outgoing user-fac
service clid_authen_collect
destination-pattern 900T
session target ipv4:CME address
incoming called-number 900T
dtmf-relay h245-alphanumeric
codec g711ulaw
no vad
dial-peer voice 69 pots
corlist outgoing fac-int
translation-profile outgoing DiscardDigit9
preference 3
destination-pattern 900T
port 0/0/0
forward-digits all
no sip-register
6- assign the proper cor list to match voip dial-peer for FAC
HTH
Anas
don't forget to rate the helpful posts

AutoCommand

Similar Messages

Maybe you are looking for