Cisco Role based views

Question

Hello,
I want to set up the following - a CLI view that will restrict different users when they login using telent or ssh.
Now for this i have enable AAA, and also create two views one for Guest and one for ADMIN.
I then have set up secret passwords for each view. Now i want user name adam to access view GUEST and username DON to access ADMIN view.
Is this possible?
Thanks,                  

Answer 1

hi,
You have the following configured:
aaa  authentication login mgmt group my_radius local
aaa authorization  exec mgmt group my_radius local
line  con 0
authorization exec mgmt
logging synchronous
login  authentication mgmt
line vty 0 4
authorization exec mgmt
logging synchronous
login authentication mgmt
transport  input ssh
Hence every time you try to login to the console or try the ssh the authentication will head to the radius server because of the following command "login  authentication mgmt".
You cannot make it locally. Whatever defined on the method list mgmt first will be taking the precedence.
enable seceret will be locally defined. but you have the following configured:
aaa  authorization  exec mgmt group my_radius local
line  con 0
authorization exec mgmt
line  vty 0 4
authorization exec mgmt
Hence exec mode will also be done via radius server.
when you configure:
aaa  authentication login VIEW_CONFG local
line vty 0 4
login  authentication VIEW_CONFG
You are making the authentication local, hence it is working the way you want.
In short, whatever authentication is defined 1st on the method list will take precendence. the fallback will be checked only if the 1st aaa server is not reachable.
Hope this helps.
Regards,
Anisha
P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.