Failover exec and command authorization

Hi, got into a dead end here. I have a pair of ASA firewalls running as active/standby. I'd like to use the 'failover exec' to issue commands on the standby firewall via the active one. This shouldn't be a problem, but we have AAA command authorization configured. And when the active ASA tries to issue a command on the stadby ASA, it gets a 'authorization denied' message. At the ACS we see the auth request being denied, the ASA sends the request using the 'enable_1' user, instead of using the same user connected to the active ASA.
Any clues on how to go around this?
thanks!

Remote command execution lets you send commands entered at the command line to a specific failover peer.
Because configuration commands are replicated from the active unit or context to the standby unit or context, you can use the failover exec command to enter configuration commands on the correct unit, no matter which unit you are logged-in to. For example, if you are logged-in to the standby unit, you can use the failover exec active command to send configuration changes to the active unit. Those changes are then replicated to the standby unit. Do not use the failover exec command to send configuration commands to the standby unit or context; those configuration changes are not replicated to the active unit and the two configurations will no longer be synchronized.
To send a command to a failover peer, perform the steps given in the below URL:
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html#wp1154924
The below URL helps you in configuring the Active/standby failover:
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html#wp1058096

Similar Messages

  • ACS command Authorization on PIX Console

    I have configured the pix firewall for ACS authentication and command authorization, everything is working fine
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ (inside) host 172.28.x.x x.x.x
    aaa-server TACACS+ (inside) host 172.28.x. xx
    aaa authentication ssh console TACACS+ LOCAL
    aaa authentication serial console LOCAL
    aaa authentication enable console TACACS+ LOCAL
    aaa authorization command TACACS+
    aaa accounting command privilege 15 TACACS+
    aaa accounting enable console TACACS+
    but porblem is that i dont wana have ACS authentication while connecting with console. In case of emergency when
    ACS down, i wana to get console and access the device by using local username and password
    but now after this configuration when i try to access the firewall via console, i m getting error of
    command authorization fail.
    I dont wana have any command authorization while connected with console, Please tell me how to resolve this issue
    I have made the command authorization set in ACS and it is working fine for me,

    kindly once again check my modified configuration,
    I wanted to use this option in case, ACS goes down and i can console my firewall and but it is not working fine me.
    aa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ (edn) host 172.28.31.132
    aaa-server TACACS+ (edn) host 172.28.31.133
    aaa authentication ssh console TACACS+ LOCAL
    aaa authentication enable console TACACS+ LOCAL
    aaa authentication serial console LOCAL
    aaa authentication http console LOCAL
    aaa authorization command TACACS+ LOCAL
    aaa accounting command privilege 15 TACACS+
    aaa accounting enable console TACACS+
    but i m not able to login i m getting following eror
    Command authorization failed
    TDC-INT-525-01> exit
    Command authorization failed
    TDC-INT-525-01> exit
    Command authorization failed
    TDC-INT-525-01> enable
    Command authorization failed
    i also defined the local command authorization set like this
    privilege cmd level 15 mode exec command exit
    privilege show level 5 mode exec command running-config
    privilege show level 15 mode exec command version
    privilege show level 0 mode exec command access-list
    privilege show level 0 mode configure command access-list
    privilege cmd level 15 mode configure command exit
    privilege cmd level 15 mode configure command no
    privilege cmd level 0 mode configure command access-list
    privilege cmd level 15 mode interface command exit
    privilege cmd level 15 mode subinterface command exit
    privilege cmd level 15 mode dynupd-method command exit
    privilege cmd level 15 mode trange command exit
    privilege cmd level 15 mode route-map command exit
    privilege cmd level 15 mode router command exit
    privilege cmd level 15 mode ldap command exit
    privilege cmd level 15 mode aaa-server-host command exit
    privilege cmd level 15 mode aaa-server-group command exit
    privilege cmd level 15 mode context command exit
    privilege cmd level 15 mode group-policy command exit
    privilege cmd level 15 mode username command exit
    privilege cmd level 15 mode tunnel-group-general command exit
    privilege cmd level 15 mode tunnel-group-ipsec command exit
    privilege cmd level 15 mode tunnel-group-ppp command exit
    privilege cmd level 15 mode mpf-class-map command exit
    privilege cmd level 15 mode mpf-policy-map command exit
    privilege cmd level 15 mode mpf-policy-map-class command exit
    privilege cmd level 15 mode mpf-policy-map-class command exit
    privilege cmd level 15 mode mpf-policy-map-param command exit
    Please tell me how to solve this problem

  • How can I use srvctl command line for change "Failover type" and "F method"

    Hi all,
    I am using Oracle One Node (11.2.0.3), and I have a service:
    /u01/11.2.0/grid/bin/srvctl config service -d orcl
    Service name: orcldb
    Service is enabled
    Server pool: orcl
    Cardinality: 1
    Disconnect: false
    Service role: PRIMARY
    Management policy: AUTOMATIC
    DTP transaction: false
    AQ HA notifications: false
    Failover type: NONE
    Failover method: NONE
    TAF failover retries: 0
    TAF failover delay: 0
    Connection Load Balancing Goal: LONG
    Runtime Load Balancing Goal: NONE
    TAF policy specification: BASIC
    Edition:
    Preferred instances: orcl_1
    Available instances:
    I would like to change "Failover type" and "Failover method" to:
    Failover type: SELECT
    Failover method: BASIC
    How can I do that? Is there any graphical tool for it? Or, How can I use srvctl command line for change it?
    Thanks in advance.
    Leonardo.

    user10674190 wrote:
    Hi all,
    I am using Oracle One Node (11.2.0.3), and I have a service:
    /u01/11.2.0/grid/bin/srvctl config service -d orcl
    Service name: orcldb
    Service is enabled
    Server pool: orcl
    Cardinality: 1
    Disconnect: false
    Service role: PRIMARY
    Management policy: AUTOMATIC
    DTP transaction: false
    AQ HA notifications: false
    Failover type: NONE
    Failover method: NONE
    TAF failover retries: 0
    TAF failover delay: 0
    Connection Load Balancing Goal: LONG
    Runtime Load Balancing Goal: NONE
    TAF policy specification: BASIC
    Edition:
    Preferred instances: orcl_1
    Available instances:
    I would like to change "Failover type" and "Failover method" to:
    Failover type: SELECT
    Failover method: BASIC
    How can I do that? Is there any graphical tool for it? Or, How can I use srvctl command line for change it?
    Thanks in advance.
    Leonardo.srvctl modify service -d database_name -s orcldb -q TRUE -m BASIC -P BASIC -e SELECT -z 180 -w 5 -j LONG
    Also see
    11gR2(11.2) RAC TAF Configuration for Admin and Policy Managed Databases [ID 1312749.1]

  • Command Authorization and the CSS

    HI,
    is it possible to do command authorization via usernames witha CSS. I want to implement something similar to the command authorization of an IOS device.
    Is there any refrence on the CCO how to setup the ACS and the CSS?
    Any hint or help is appreciated.
    Kind Regards,
    Joerg

    http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a0080192ef2.html#wp1077431
    The ACS setup would be the same as for ios I believe.
    Gilles.

  • Problem - acs command authorization and web access control

    Hi, I'm trying to add the control of some aironet 1310 bridges with a ACS 3.2 (tacacs+). I wanted to be able to do telnet command authorization restrictions trough shell command authorization sets and be able to give similar restrictive web access at the same time. I have it working if I permit some commands that are sent by the browser as "write memory quiet" and few other ones, but for it to work, I must give them limited users the privilege level 15 and by having the tacacs server authorizing the commands, it work for both, http and telnet. Where my problem begin is when I loose the connection with the ACS server, the user being already authenticated as level 15 user, the device become open to all commands; there is no more restriction applied by the ACS. Do anybody now a workaround.

    It is already at local, that is just that the user already have a level 15 access and I used to control the commands through level settings before. So when I try it, my user that is localy level 5 is already recognized as a level 15 user from when it was authenticated through the ACS. If I could find a way to give web access to the 1310 at priv level 5 and still controlling the command set, it would be ok but as soon as I try to access a page that is not permitted other way than by the view level (i think it's level 1... or 0), I get a username password prompt with that line on the top of it:"level_15_or_view_access" and the only way I can access it is by entering a level 15 un/pass. I attached my 1310 aaa config
    and here are the command set that work at level 15 to do a "shut" or "no shut" of the radio interface by the web interface:
    configure
    permit terminal
    exit
    permit Unmatched Args
    interface
    permit Dot11Radio0
    no
    permit shutdown
    permit cca
    ping
    permit Unmatched Args
    show
    permit Unmatched Args
    shutdown
    permit Unmatched Args
    telnet
    permit Unmatched Args
    write
    permit memory quiet
    Thanks for the help !

  • Cisco Secure ACS 4.2 - Group Setup w/Shell Command Authorization Sets

    Hello All,
    I am trying to create a user so that I can provide him only to run commands that I have designated them to run within my "Shell Command Authorization Set". This seems to work great, however I cannot find anywhere I can "hide" commands they do not have access to. For instance, once the user is logged into the switch they can do a show ? and get a list of commands. I would like to know if there is an option to only display commands the user has access to in ACS.
    My Steps:
    Created a user in ACS
    Shared Profile Components
    Create Shell command Autorization Set - "ReadOnly"
    Unmatched Commands - Deny
    Unchecked - Permit Unmatched Arg
    Commands Added
    permit interface
    permit vlan
    permit snmp contact
    permit power inline
    permit version
    permit switch
    permit controllers utilization
    permit env all
    permit snmp location
    permit ip http server status
    permit logging
    Created a group - "GroupTest" with the following
    Confirgured - Network Access Restrictions (NAR)
    Max Sessions - Unlimited
    Enable Options - No Enable Privilege
    TACACS+ Settings
    Shell (exec)
    Priviledge level is check with 1 as the assigned level
    Shell Command Authorization Set
    "ReadOnly" - Assign a Shell Command Authorization Set for any network device
    I have configured following on my Router/Switch
    aaa authorization config-commands
    aaa authorization commands 1 default group tacacs+ if-authenticated
    privilege exec level 1 show log
    I have attached below the documention I have gone over.
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/GrpMgt.html#wp478624

    "you are testing with privilege level 15 or below 15. Because when you are using below 15 level user, first it will check local command authorization set. For example if you want to execute sh runn command with level 5 user, first it will check local command set. If the sh runn command exits in local command set then it will send request to ACS. If it is not in the command set, it won't send request to ACS. That's why you don't see debug. For 15 level users it will directly send request to ACS. Configure command set locally and try it should work.
    Correct me if I am wrong."
    Regards
    Vamsi

  • Command authorization error when using aaa cache

    Hi,
    I'm trying to use the aaa cache mode for command authorization. But when I execute a command there is always an error message:
    % tty2 Unknown authorization method 6 set for list command
    The command is then always authorized against the tacacs server.
    The 'authentication login', 'authentication enable' and 'authorization exec' are using the cache properly.
    I have tried it with an Accesspoint AIR-AP1242AG-E-K9, IOS 12.3(8)JEA and a Catalyst WS-C3550-24PWR-SMI, IOS 12.2(35)SE with the same results.
    Deleting the cache entry and using only the tacacs group the error message disappears.
    Any suggestions?
    Thanks.
    Frank
    ======
    config
    ======
    aaa new-model
    aaa group server tacacs+ group_tacacs
    server 10.10.10.10
    server 10.10.10.11
    cache expiry 12
    cache authorization profile admin_user
    cache authentication profile admin_user
    aaa authentication login default cache group_tacacs group group_tacacs local
    aaa authentication enable default cache group_tacacs group group_tacacs enable
    aaa authorization console
    aaa authorization config-commands
    aaa authorization exec default cache group_tacacs group group_tacacs local
    aaa authorization commands 15 default cache group_tacacs group group_tacacs local
    aaa accounting exec default start-stop group group_tacacs
    aaa cache profile admin_user
    profile admin no-auth
    aaa session-id common
    tacacs-server host 10.10.10.10 single-connection
    tacacs-server host 10.10.10.11 single-connection
    tacacs-server directed-request
    tacacs-server key 7 <removed>
    ============
    debug output
    ============
    ap#
    Feb 7 20:02:37: AAA/BIND(00000004): Bind i/f
    Feb 7 20:02:37: AAA/AUTHEN/CACHE(00000004): GET_USER for username NULL
    Feb 7 20:02:39: AAA/AUTHEN/CACHE(00000004): GET_PASSWORD for username admin
    Feb 7 20:02:42: AAA/AUTHEN/CACHE(00000004): PASS for username ^->o
    Feb 7 20:02:42: AAA/AUTHOR (0x4): Pick method list 'default'
    Feb 7 20:02:42: AAA/AUTHOR/EXEC(00000004): processing AV cmd=
    Feb 7 20:02:42: AAA/AUTHOR/EXEC(00000004): processing AV priv-lvl=15
    Feb 7 20:02:42: AAA/AUTHOR/EXEC(00000004): Authorization successful
    ap#
    Feb 7 20:02:54: AAA: parse name=tty2 idb type=-1 tty=-1
    Feb 7 20:02:54: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=2 channel=0
    Feb 7 20:02:54: AAA/MEMORY: create_user (0xBA9C34) user='admin' ruser='ap' ds0=0 port='tty2' rem_addr='10.10.1.1' authen_type=ASCII service=NONE priv=15 initial_task_id='0', vrf= (id=0)
    Feb 7 20:02:54: tty2 AAA/AUTHOR/CMD(787222339): Port='tty2' list='' service=CMD
    Feb 7 20:02:54: AAA/AUTHOR/CMD: tty2(787222339) user='admin'
    Feb 7 20:02:54: tty2 AAA/AUTHOR/CMD(787222339): send AV service=shell
    Feb 7 20:02:54: tty2 AAA/AUTHOR/CMD(787222339): send AV cmd=show
    Feb 7 20:02:54: tty2 AAA/AUTHOR/CMD(787222339): send AV cmd-arg=running-config
    Feb 7 20:02:54: tty2 AAA/AUTHOR/CMD(787222339): send AV cmd-arg=<cr>
    Feb 7 20:02:54: tty2 AAA/AUTHOR/CMD(787222339): found list "default"
    Feb 7 20:02:54: % tty2 Unknown authorization method 6 set for list command
    Feb 7 20:02:54: AAA/AUTHOR (787222339): Post authorization status = ERROR
    Feb 7 20:02:54: tty2 AAA/AUTHOR/CMD(787222339): Method=group_tacacs (tacacs+)
    Feb 7 20:02:54: AAA/AUTHOR/TAC+: (787222339): user=admin
    Feb 7 20:02:54: AAA/AUTHOR/TAC+: (787222339): send AV service=shell
    Feb 7 20:02:54: AAA/AUTHOR/TAC+: (787222339): send AV cmd=show
    Feb 7 20:02:54: AAA/AUTHOR/TAC+: (787222339): send AV cmd-arg=running-config
    Feb 7 20:02:54: AAA/AUTHOR/TAC+: (787222339): send AV cmd-arg=<cr>
    Feb 7 20:02:54: AAA/AUTHOR (787222339): Post authorization status = PASS_ADD
    Feb 7 20:02:54: AAA/MEMORY: free_user (0xBA9C34) user='admin' ruser='ap' port='tty2' rem_addr='10.10.1.1' authen_type=ASCII service=NONE
    priv=15 vrf= (id=0)

    Hi,
    I really do not think that command authorization results will be cached. The cache keeps the user credentials and attributes passed during exec authorization but for command authorization it would have to check with the tacacs server always.
    Regards,
    Vivek

  • Command Authorization in ACS 5.0

    Hi,
    Can anybody route me to configuration example for command authorization in routers or switches or firewall for ACS 5.0.
    OR
    USER-A should be placed in privilege level 2 and given access to all debug commands and the undebug all command.
    Assigned specified commands to level 2
    privilege exec level 2 undebug all
    privilege exec all level 2 debug
    The commands what i applied on routers are above.How i can set a privilege level of 2 on user in ACS 5.0.??????
    Also if i want to do shell command authorization set,how can i do it in ACS 5.0
         Thanks,

    You need to create a shell profile to assign the desired privilege level, and a command set to authorize specific commands, then associate those two with the authorization policy that applies to those users.

  • Command authorization issue.

    Hello.
    I'm using commands authorization with Cisco Secure ACS 4.1. This morning I'm going to set the MOTD and entries fail because my banner starts with a blank.
    The shell command set that I'm using is a "permit unmatched commands".
    Any idea?
    Thanks.
    Andrea

    What you're experiencing is a known defect:
    CSCtg38468    cat4k/IOS: banner exec failed with blank characters
    Symptom:
    %PARSE_RC-4-PRC_NON_COMPLIANCE:
    The above parser error can be seen together with traceback, when configuring a banner containing a blank character at the begining of line.
    Conditions:
    Problem happens, when AAA authorization is used together with TACACS+
    Workaround:
    Make sure there is no blank character at the begining of line in the banner message.
    Problem Details: trying to configure banner exec with blank character at beginning of line failed.
    This happens when configuring the banner exec via telnet/ssh !
    When configuring the same banner exec via console-port, everything is fine.
    Note the blank characters at beginning of each line. When removing those, banner exec works fine.
    Again, this was working till IOS version 12.2(46)SG.
    Beginning with 12.2(50)SG1 and up, the behaviour has changed.
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • Do I need privilege exec level commands in router?

    Do I need privilege exec level commands in router if the user was setup in TACACS server with specific privilege exec already?
    The user is getting "Command authorization failed" error even was setup with "priv-lvl = 4" for TACACS server.
    If changed to AAA with local authentication then is fine without privilege exec level 4 commands in router.

    If you are using command authorization then privilage doesn't matter.
    Best way to set it up is to give all user priv lvl 15 and then define what all commands user can execute.
    Note : Having priv 15 does not mean that user will able to issue all commands.
    We will set up command authorization on acs to have control on users.
    This is how your config should look,
    aaa authentication login default group tacacs+ local
    aaa authorization exec default group tacacs+ if-authenticated
    aaa authorization commands 1 default group tacacs+ if-authenticated
    aaa authorization commands 15 default group tacacs+ if-authenticated
    aaa authorization config-commands
    aaa accounting commands 1 default start-stop group tacacs+
    aaa accounting commands 15 default start-stop group tacacs+
    Regards,
    ~JG
    Do rate helpful posts

  • ACS command authorization - deny CatOS "set" commands

    Cisco Secure ACS 4.2
    I have a network support group that i just want to deny them the ability to use IOS and CatOS configuration commands.
    I noticed that the Per Group Command Authorization is applicable to only IOS-based commands. I applied it to deny "configure", but permit everything else.
    How do I go about setting this group up to deny set-based commands for the CatOS devices?

    Hi
    CatOS does TACACS+ right? Pretty sure it does. If it has a "shell/exec" service like IOS then ACS wont really care whether the command authorisation is IOS or CatOS - it doesnt have any specific command set knowledge. ie it uses string comparisons between what the device is requesting and what is permitted.
    However, if the command authorisations are totally different (between IOS and catos devices) you might need to place them into separate NDGs so that you can map an IOS NDG to an IOS device command set and vice versa.
    Hope that makes sense!

  • FWSM: AAA authentication using TACACS and local authorization

    Hi All,
    In our setup, we are are having FWSMs running version 3.2.22 and users are authenticating using TACACS (running cisco ACS). We would like to give restricted access ( some show commands ) to couple of users to all devices. We do not want to use TACACS for command authorization.
    We have created users on TACACS and  not allowed "enable" access to them. I have also given those show commands locally on the firewall with privilege level 1. and enabled aaa authorization LOCAL
    Now , those users can successfully login to devices and execute those show commands from priv level 1 except "sh access-list".  I have specifically mentioned this
    "privilege show level 1 mode exec command access-list"  in the config.
    Is there anything i am missing or is there any other way of doing it?
    Thanks.

    You cannot do what you are trying to do. For (default login you need to use the first policy matched.
    you can diversify telnet/ssh with http by  creating different aaa groups.
    But still you will be loging in for telnet users (all of them) using one method.
    I hope it is clear.
    PK

  • Command authorization for ASA

    Hi all
       I have configured ASA firewall for command authorization with ACS.For users with privilege level 15 it is working fine.But when i login with users with privilege level 0, first when i enter the username and password ,it enters into enable mode.But after that when i put the enable password ,it is not working.password is not working.I configured to use the same PAP password option in the ACS enable section for the user.Also is it possible in ASA is it possible when user enters username and password,he could directly log into the exec mode rather than enable mode and assign privilege for the user as configured in the ACS user configuration.
    Thanks in advance
    Anvar

    Hi Dan
      I have alredy configured enable password using tacacs+.Please find my aaa config on ASA
    aaa authentication telnet console TACACS-SERVER LOCAL
    aaa authentication http console TACACS-SERVER LOCAL
    aaa authentication ssh console TACACS-SERVER LOCAL
    aaa authentication enable console TACACS-SERVER LOCAL
    aaa authentication serial console LOCAL
    aaa authorization command TACACS-SERVER LOCAL
    aaa accounting telnet console TACACS-SERVER
    aaa accounting command TACACS-SERVER
    aaa accounting ssh console TACACS-SERVER
    regards
    anvar

  • Failover exec active write mem

    Hi Everyone,
    I was doing config change on firewall  in multicontext mode.
    IT has 2 contexts  admin and X.
    I log into admin context via ASDM and switch to context X with the  ASDM as  need to make changes to context firewall X.
    When i config the changes via asdm and click on apply it show me message
    failover exec active write mem followed by ACL which i was going to apply.
    Need to confirm if above command is safe to run on production network without causing any issues?
    Finally i logged into Context X which was admin for that and made the chnages via CLI.

    hi mahesh,
    i'm suspecting you're making changes in context x from the standby unit. you could verify with show failover command.
    it's safe to assume to issue a failover exec active write mem since you're just saving the config for the active unit.
    you could alternatively use the write memory all command to save the system and all context config changes.

  • Shell Command Authorization Sets ACS

    hi i followed this guide step by step http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml
    but still all my user  can use all the commands
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname R3
    boot-start-marker
    boot-end-marker
    aaa new-model
    aaa authentication login milista group tacacs+ local
    aaa authorization config-commands
    aaa authorization exec default group tacacs+ local
    aaa authorization commands 0 default group tacacs+ local
    aaa authorization commands 1 default group tacacs+ local
    aaa authorization commands 15 default group tacacs+ local
    aaa session-id common
    memory-size iomem 5
    ip cef
    no ip domain lookup
    ip auth-proxy max-nodata-conns 3
    ip admission max-nodata-conns 3
    multilink bundle-name authenticated
    username admin privilege 15 secret 5 $1$CS17$3oeNpzTvJAyZTvOUP2qyB1
    archive
    log config
    hidekeys
    interface FastEthernet0/0
    ip address 192.168.20.1 255.255.255.0
    duplex auto
    speed auto
    interface Serial0/0
    no ip address
    shutdown
    clock rate 2000000
    interface FastEthernet0/1
    no ip address
    shutdown
    duplex auto
    speed auto
    interface Serial0/1
    ip address 20.20.20.2 255.255.255.252
    clock rate 2000000
    interface Serial0/2
    no ip address
    shutdown
    clock rate 2000000
    interface Serial0/3
    no ip address
    shutdown
    clock rate 2000000
    router eigrp 1
    network 20.0.0.0
    network 192.168.20.0
    no auto-summary
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    tacacs-server host 192.168.20.2 key cisco
    control-plane
    line con 0
    exec-timeout 0 0
    logging synchronous
    login authentication milista
    line aux 0
    line vty 0 4
    end
    i copy the authorization commands from the cisco forum and follow  the steps but no thing all my users have full access to all commands
    heres my share profile
    name-------------admin jr
    Description---------for jr admin
    unmatched commands------- ()permit  (x)deny
    permint unmatched args()
    enable
    show -------------------------- permit version<cr>
    permit runnig-config<cr>
    then i add this profifle to group 2 and then i add my user to the group 2
    then i log in to the router enter with the user and i still can use ALL the commands i dont know what i am doign bad any idea?
    can you  give me  if you can a guide to setup authorization with ACS i cant find any good guide  jeremy from CBT gives a example but just for authentication i am lost  i am battling with this  prblem since wednesday without luck

    "you are testing with privilege level 15 or below 15. Because when you are using below 15 level user, first it will check local command authorization set. For example if you want to execute sh runn command with level 5 user, first it will check local command set. If the sh runn command exits in local command set then it will send request to ACS. If it is not in the command set, it won't send request to ACS. That's why you don't see debug. For 15 level users it will directly send request to ACS. Configure command set locally and try it should work.
    Correct me if I am wrong."
    Regards
    Vamsi

Maybe you are looking for