No "configure" command in enable mode?

Got a 1142AG LAP from eBay.
Connect console cable to it. Seems to be able to get into priviledge mode. But there's no "configure" command available. What can I do? Thanks!
AP0017.5a9b.08a4#?
Exec commands:
cd               Change current directory
clear            Reset functions
clock            Manage the system clock
crypto           Encryption related commands.
debug            Debugging functions (see also 'undebug')
delete           Delete a file
dir              List files on a filesystem
disable          Turn off privileged commands
dot11            IEEE 802.11 commands
enable           Turn on privileged commands
exit             Exit from the EXEC
fsck             Fsck a filesystem
help             Description of the interactive help system
led              LED functions
lock             Lock the terminal
login            Log in as a particular user
logout           Exit from the EXEC
mkdir            Create new directory
monitor          Monitoring different system events
more             Display the contents of a file
name-connection Name an existing network connection
no               Disable debugging functions
ping             Send echo messages
pwd              Display current working directory
release          Release a resource
reload           Halt and perform a cold restart
rename           Rename a file
renew            Renew a resource
rmdir            Remove existing directory
save             Start to save raise_interrupt_level stack
send             Send a message to other tty lines
set              Set system parameter (not config)
show             Show running system information
systat           Display information about terminal lines
terminal         Set terminal line parameters
test             Test subsystems, memory, and interfaces
traceroute       Trace route to destination
undebug          Disable debugging functions (see also 'debug')
upgrade          Upgrade software
verify           Verify a file
where            List active connections
AP0017.5a9b.08a4#sh ver
Cisco IOS Software, C1240 Software (C1240-K9W8-M), Version 12.3(7)JX3, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Tue 28-Feb-06 21:32 by kellythw
ROM: Bootstrap program is C1240 boot loader
BOOTLDR: C1240 Boot Loader (C1240-BOOT-M) Version 12.3(7)JA1, RELEASE SOFTWARE (fc1)
AP0017.5a9b.08a4 uptime is 1 hour, 24 minutes
System returned to ROM by power-on
System image file is "flash:/c1240-k9w8-mx.123-7.JX3/c1240-k9w8-mx.123-7.JX3"
cisco AIR-LAP1242AG-A-K9   (PowerPCElvis) processor (revision A0) with 24566K/8192K bytes of memory.
Processor board ID FTX1014B0RD
PowerPCElvis CPU at 266Mhz, revision number 0x0950
Last reset from power-on
1 FastEthernet interface
2 802.11 Radio(s)
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:17:5A:9B:08:A4
Part Number                          : 73-9925-04
PCA Assembly Number                  : 800-26579-04
PCA Revision Number                  : A0
PCB Serial Number                    : FOC10130VCR
Top Assembly Part Number             : 800-26804-02
Top Assembly Serial Number           : FTX1014B0RD
Top Revision Number                  : B0
Product/Model Number                 : AIR-LAP1242AG-A-K9
Configuration register is 0xF

The AP has been converted to lightweight:
C1240-K9W8-M
The K9W8 is lightweight and K9W7 is autonomous. You need a WLC for the K9W8. If you have an autonomous image, you can convert it back:
Using a TFTP Server to Return to a Previous Release
http://www.cisco.com/en/US/docs/wireless/access_point/conversion/lwapp/upgrade/guide/lwapnote.html#wp160918
https://supportforums.cisco.com/docs/DOC-18268
http://www.cisco.com/en/US/docs/wireless/access_point/conversion/lwapp/upgrade/guide/lwapnote.html#wp160918
http://www.youtube.com/watch?v=QQ_NuxdRhQ4
https://supportforums.cisco.com/docs/DOC-14960
Thanks,
Scott
*****Help out other by using the rating system and marking answered questions as "Answered"*****

Similar Messages

AIR-LAP1242AG-A-K9 configure command does not seem to exist

I have an AIR-LAP1242AG-A-K9. Straight out of the box I thought it would have the GUI functional but this is not the case. I am brand new to Cisco products so it is taking me a while to get use to them and to TelNet but from what I have read in about 6 different manuals none have explained how I can access the configure terminal command when It doesn't show up. I am in privileged mode with access of:
AP001c.588e.a266#show privilege
Current privilege level is 15
Version is 12.3(7)JA1, RELEASE SOFTWARE (fc1). I haven't changed any settings except the ip settings and time and date.
AP001c.588e.a266# ? gives me
cd Change current directory
clear Reset functions
clock Manage the system clock
crypto Encryption related commands.
debug Debugging functions (see also 'undebug')
delete Delete a file
dir List files on a filesystem
disable Turn off privileged commands
enable Turn on privileged commands
exit Exit from the EXEC
fsck Fsck a filesystem
help Description of the interactive help system
led LED functions
lock Lock the terminal
login Log in as a particular user
logout Exit from the EXEC
lwapp lwapp exec commands
mkdir Create new directory
more Display the contents of a file
name-connection Name an existing network connection
no Disable debugging functions
ping Send echo messages
but no configure command
If I try to use the configure command I get
AP001c.588e.a266#configure terminal
^
% Invalid input detected at '^' marker
If it helps any if I use show configuration command:
startup-config is not present
If I can't get into global configuration mode I cant enable the GUI, turn on the wireless, or do much of anything else so I need some help.
Any would be appreciated,
Matt Brown

Hi Matt,
The problem here is that the AP you received is a Lightweight AP which is meant to be used with Wireless Lan Controllers and WCS. The "LAP" portion of the part number shows this Lightweight designation. This can be converted to an Autonomous/stand-alone AP that you desire;
Here is a conversion method;
Reverting the Access Point Back to Autonomous Mode
http://www.cisco.com/en/US/products/hw/wireless/ps430/prod_technical_reference09186a00804fc3dc.html#wp161272
You can convert an access point from lightweight mode back to autonomous mode by loading a Cisco IOS Release that supports autonomous mode (Cisco IOS release 12.3(7)JA or earlier). If the access point is associated to a controller, you can use the controller to load the Cisco IOS release. If the access point is not associated to a controller, you can load the Cisco IOS release using TFTP.
Using a TFTP Server to Return to a Previous Release
Follow these steps to revert from LWAPP mode to autonomous mode by loading a Cisco IOS release using a TFTP server:
Step 1 The static IP address of the PC on which your TFTP server software runs should be between 10.0.0.2 and 10.0.0.30.
Step 2 Make sure that the PC contains the access point image file (such as c1200-k9w7-tar.122-15.JA.tar for a 1200 series access point) in the TFTP server folder and that the TFTP server is activated.
Step 3 Rename the access point image file in the TFTP server folder to c1200-k9w7-tar.default for a 1200 series access point, c1130-k9w7-tar.default for an 1130 series access point, and c1240-k9w7-tar.default for a 1240 series access point.
Step 4 Connect the PC to the access point using a Category 5 (CAT5) Ethernet cable.
Step 5 Disconnect power from the access point.
Step 6 Press and hold MODE while you reconnect power to the access point.
Step 7 Hold the MODE button until the status LED turns red (approximately 20 to 30 seconds) and then release.
Step 8 Wait until the access point reboots, as indicated by all LEDs turning green followed by the Status LED blinking green.
Step 9 After the access point reboots, reconfigure it using the GUI or the CLI.
From this doc;
http://www.cisco.com/en/US/products/hw/wireless/ps430/prod_technical_reference09186a00804fc3dc.html#wp161272
Hope this helps!
Rob

Log into Device with AAA, how do I get right into enable mode?

I am using a Cisco ACS server with an RSA server behind it. When the user is authenticated from the ACS server, I want them to go straight into enable mode, not have to type the enable mode password. What line am I missing?
aaa authentication login ACS group ACS_servers local enable
aaa authorization exec ACS group ACS_servers local
aaa authorization commands 15 ACS group ACS_servers local
aaa accounting commands 1 default start-stop group ACS_servers
aaa accounting commands 15 default start-stop group ACS_servers
line vty 0 5
login authentication ACS
authorization commmands 15 ACS

The configuration in question is for telnet, but I do need to design my new console access connection. Console access would be either remotely or on-site, but I don't feel comfortable giving priv 15 right into it. I plan to use the same authentication method on the console (ACS group 1st, local database 2nd) and will just have to enter the enable password through the console.
One more question on the aaa config, I kept getting this error in the log:
AAA/AUTHOR: config command authorization not enabled
So I added:
aaa authorization config-commands
I don't know if it was needed because I could still execute config-commands, but it kept giving me that warning if I didn't have that line.
Also, do I really need this line if the ACS server is taking care of priv 15 authorization:
aaa authorization commands 15 ACS if-authenticated

Logging directly into enable mode on a PIX using TACACS

I have setup TACACS authentication on a PIX running 6.3(3). I can authenticate using TACACS just fine, but do not get put directly into enable mode. The ACS server is setup to do so, it works for routers and switches, but not the PIX box. If I put the "aaa authentication enable console TACACS" in the config I must enter the enable command and use the same password I logged in with to get into enable mode. Without the command, I have to use the configured enable secret password to get into the enable mode.
Does anyone know it there is a way to configure the PIX to log someone directly into enable mode via TACACS?
Thanks in advance

Hi,
PIX does not support exec authorization. Hence user cannot login to level 15 directly.
Regards,
Vivek

Enable mode using privilege levels

Hi All,
We use TACACS+ for telnet access and enable secret password for privileged access. An user would like to enter the enable mode without entering the enable secret password. Is it possible to do this using privilege levels and shell exec on the AAA server?

I have configured a user on AAA server and under the enable options, I have selected level 15 and under shell exec, I have selected privilege level 15.
The router has following config
aaa authorization exec default tacacs+ if-authenticated
aaa authorization commands 1 default tacacs+ if-authenticated
aaa authorization commands 15 default tacacs+ if-authenticated
Am I missing any other commands?

How to skip enable mode password prompt.

Hi,
I just installed ACS 4.1 (first time working with ACS). Everything is working great and I'm using the ACS internal database for user authentication.
The question I have is this. When logging into a router, which is authenticating against the ACS server, is there a way to bypass having to enter my password a second time to get to enable mode??
Currently, I have to enter my username and password to login to the router and when I go to enable mode, I have to re-enter my password again.
Any help is greatly appreciated.
Thanks,
Tony

Hi,
Here's my two penny's worth;
I would take off the "authorization" lines as these are only needed to authorize exec and commands:
no aaa authorization exec default group tacacs+ if-authenticated
no aaa authorization commands 15 default group tacacs+ if-authenticated
I would also remove the authentication enable line as this tells the device to authenticate enable mode access
no aaa authentication enable default group tacacs+ enable
And just test with the authentication login line, leave the accounting lines for now
I would double check the following in ACS:
Is the device in the right NDG?
Do you have Per Group Defined Network Access Restrictions defined for this device?
Is the user in the right group?
In the group settings, Check you have Shell(exec) enabled, Privilege level set to 15, and under Enable Options ensure you have the right Priv level defined, per device, per group etc.
Do you have either Shell Command Authorization Set or Per Group Command Authorization radio button selected?
If you have Shell Command Authorization Set for the group ensure you have Unmatched Commands Permit selected.
And authentication should be ok, then you can troubleshoot the authorization part...
Is this on an appliance or other operating system? My experience of the appliances are that they're pretty c**p, too many bugs and little things that don't work...
Just for info, you should have a last resort local username configured if ACS is down:
username priv 15 password
This will give you local access, and, if you find you have access issues as you have, you can remove the device from ACS, so it doesn't know about it, the device will try ACS not a get a response after the timeout period and prompt you for your username, enter your local password and you're in...
I hope this helps...

Enable mode authorization failed.

Have a user that cannot get to en prompt. Here is my trace output:
AAA/AUTHEN: update_user user='lduncan' ruser='(null)' port='telnet146' rem_addr=
'10.128.20.110' authen_type=1 service=ENABLE priv=152007 Oct 16 10:57:07.360 EST
-04:00
AAA/AUTHEN/START (0): port='telnet146' list='(null)' action=LOGIN service=ENABLE
TAC+: send AUTHEN/START packet ver=192 id=626074205
TAC+: Opening TCP/IP connection to 10.129.12.196
TAC+: ver=192 id=626074205 received AUTHEN status = GETPASS2007 Oct 16 10:57:08.
440 EST -04:00
AAA/AUTHEN (626074205): status = GETPASSPassword: 2007 Oct 16 10:57:11.200 EST -
04:00 *62*2007 Oct 16 10:57:11.440 EST -04:00 *69*2007 Oct 16 10:57:11.800 EST -
04:00 *67*2007 Oct 16 10:57:12.050 EST -04:00 *74*2007 Oct 16 10:57:12.300 EST -
04:00 *6f*2007 Oct 16 10:57:12.530 EST -04:00 *65*
2007 Oct 16 10:57:12.950 EST -04:00
AAA/AUTHEN/CONT (626074205): continue_login2007 Oct 16 10:57:12.950 EST -04:00
AAA/AUTHEN (626074205): status = GETPASS
TAC+: send AUTHEN/CONT packet id=626074205
TAC+: ver=192 id=626074205 received AUTHEN status = PASS2007 Oct 16 10:57:13.460
EST -04:00
AAA/AUTHEN (626074205): status = PASS2007 Oct 16 10:57:13.460 EST -04:00 return
PASS
2007 Oct 16 10:57:13.460 EST -04:00
AAA/AUTHOR : ptr2=enable
2007 Oct 16 10:57:13.470 EST -04:00
AAA/AUTHOR : Add AV service=shell
2007 Oct 16 10:57:13.470 EST -04:00
AAA/AUTHOR : Add AV cmd=enable
2007 Oct 16 10:57:13.470 EST -04:00
AAA/AUTHOR/TACACS+ cmd author (413075467): Port='telnet146' list='(null)' servic
e=CMD2007 Oct 16 10:57:13.480 EST -04:00
AAA/AUTHOR/TACACS+ cmd author: (413075467) user='lduncan'2007 Oct 16 10:57:13.4
80 EST -04:00
AAA/AUTHOR/TACACS+ cmd author: (413075467) send AV service=shell2007 Oct 16 10:5
7:13.480 EST -04:00
AAA/AUTHOR/TACACS+ cmd author: (413075467) send AV cmd=enable
AAA/AUTHOR/TACACS+ cmd author: (413075467) Method=TAC_PLUS2007 Oct 16 10:57:13.4
90 EST -04:00
AAA/AUTHOR/TAC+: (413075467): user=lduncan2007 Oct 16 10:57:13.490 EST -04:00
AAA/AUTHOR/TAC+: (413075467): send AV service=shell2007 Oct 16 10:57:13.490 EST
-04:00
AAA/AUTHOR/TAC+: (413075467): send AV cmd=enable
TAC+: Opening TCP/IP connection to 10.129.12.196
TAC+: (413075467): received author response status = FAIL2007 Oct 16 10:57:14.50
0 EST -04:00
AAA/AUTHOR (413075467): Post authorization status = FAIL2007 Oct 16 10:57:14.500
EST -04:00
AAA/AUTHOR : do_author result=12007 Oct 16 10:57:14.500 EST -04:00 %AAA: author:
tacacs_plus_author ret=1.
Enable mode authorization faile
I have checked his user info and group info in tacacs.

It seems that you have command author configured that is why user in not able to issue it.
What kind of user is it ? Admin or normal user.
To make him login you need to make changes in the command author set.
Make one command autho set in acs --->shared profile componenets.
add-->give any name "Full access "---> Put radio button to permit and submit.
Now go to that group-->Under Shell Command Authorization Set---> Choose--->Assign a Shell Command Authorization Set for any network device and select FULL ACCESS from list and submit apply.
Now it should let you in.
Caution : This is let that uses to issue all commands
Also provide me more info if you want user to deny some commands. We need to set up command autho set accordingly.
Regards,
~JG
Please rate helpful posts

SHOW commands without ENABLE...?

I have a user who has been given read-only, privilege level 1, access and wants the ability to use the various SHOW commands. We have ACS running in this environment. Is there a way, through ACS, to give him these commands?
Policy Elements/Authorization and Permissions/Device Administration/Shell Profiles has ReadOnly with all shell attributes set to not in use, default/max privilege set to 1, nothing extra in custom attributes. Same set of submenus, Command Sets, Limited has "Permit" "SHOW" with no arguments listed. Under Access Policies, Standard Device Admin, Authorization, I have a rule for the identity group assigned to the user in all locations and all device types that assigns the shell profile of ReadOnly and the command set of Limited. However, the user cannot perform any such commands
What am I missing? Is there another way to do this? As I said, the key is to provide the show commands without the ability to make changes to the devices.

Yes this can be done and it sounds like you have ACS configured correctly. However, I am not sure if all show commands will be available without entering enable mode. For example, show interfaces is not available until after you enter enable mode.
What AAA commands do you have running on the devices?
I am doing pretty much what you're doing but I allow the user to enter enable mode and then restrict them to a hand full of commands. Also, I have ACS controlling the enable password on a per user basis.

Pix/Radius and enable mode

Hi all, I am trying to get a pix 6.3 to authenticate telnet users via radius with a Microsoft IAS server. This works well, but Im trying to get it where when they log in, it just dumps them into enable mode, instead of typing in the enable AD credential again. Anyone have any insight on how to do this? Its a IAS configuration thing I know, but not sure what to do with it. Thanks in advance.

If you mean on firewall,
Username: alfa
Password: ********
pixfirewall#
Rather then,
Username: alfa
Password: ********
pixfirewall>
pixfirewall>enable
Password: ********
pixfirewall#
The unfortunately, Pix firewall does not have this concept, like IOS devices have.
On IOS you can get the user log directly into enable (Privileged exec) mode by passing attribute,
cisco av-pair as shell:priv-lvl=n or on some IOS only using Service Type as Administrative will do the trick.
Where, n is the privilege level.
AND, there has to be an EXEC authorization command on the IOS device, e.g.,
aaa authorization exec group radius....
Unfortunately, that is not the case for the Pix firewall, they have a different OS.
Regards,
Prem
Please rate if it helps!

Router clock set configuration command missing

I am running 12(3)13 on my 3620 router. The only options to the clock command are summer-time and time-zone. I want to set the system clock and if I type clock set, I get an invalid response.
Any clues?

Probably you are in configuration mode. You need to set clock from enable prompt
2621-B#clock set ?
hh:mm:ss Current Time
2621-B#conf t
Enter configuration commands, one per line. End with CNTL/Z.
2621-B(config)#clock ?
summer-time Configure summer (daylight savings) time
timezone Configure time zone

Configuring php5 with enable XML on OAS 10.1.3.x

My requirement is to enable XML on OAS 10.1.3.5.
I am not sure how to configure it, so I stated using separate PHP5.2 to configure with XML enable on the server. After installation, when I am starting the opmn services I am getting below error. I think the error with platform. Which means current OS version is 64bit and php5.2 stage is 32bit version I guess.
OAS_HOME=/u20/app/MSRV1P/apmsrv1p/oracle/product/OAS
URL : http://nacisdell277.us.oracle.com:10330/phpinfo.php
I used below command to configure :
./configure prefix=$ORACLE_HOME/php with-config-file-path=$ORACLE_HOME/Apache/Apache/conf --with-apxs=$ORACLE_HOME/Apache/Apache/bin/apxs
with-oci8=instantclient,/u20/app/MSRV1P/apmsrv1p/oracle/product/instantclient_10_2 with-config-file-path=/u20/app/MSRV1P/apmsrv1p/oracle/product/OAS/Apache/Apache/php5--enable-sigchild enable-xml enable-simplexml enable-libxml enable-dom enable-simplexml enable-xml enable-xmlreader enable-xmlwriter enable-simplexml –with-xsl -with-zlib with-xml --with-libxml-dir
Error :
/u20/app/MSRV1P/apmsrv1p/oracle/product/OAS/Apache/Apache/bin/apachectl startssl: execing httpd
Syntax error on line 247 of /u20/app/MSRV1P/apmsrv1p/oracle/product/OAS/Apache/Apache/conf/httpd.conf:
Cannot load /u20/app/MSRV1P/apmsrv1p/oracle/product/OAS/Apache/Apache/libexec/libphp5.so into server: /u20/app/MSRV1P/apmsrv1p/oracle/product/OAS/Apache/Apache/libexec/libphp5.so: wrong ELF class: ELFCLASS64
I checked in the Metalink for “configuring php5 with enable XML on OAS 10.1.3.x” but I couldn’t find anything.
Please advise me on this.
Thanks

Hello;
You can try installing glibc-devel to fix this.
However on my version :
Application Server Control Release 10.1.2.3.0 - PHP 5 does not seem to work. The conflict on mine is that PHP 4 came wrapped in the Oracle install and they don't play well together.
Make sure your httpd.conf does not have this in it :
LoadModule php4_module libexec/libphp4.soI'm NOT advising you to remove it if its there, I'm merely pointing to a possible conflict.
Best Regards
mseberg
Later
Glad you don't have the same version as me. Hard to find anything on this, found these ( Not exact matches )
http://php.net/manual/en/oci8.installation.php ( Search for ELF )
http://enlinea.creaelicita.cl/guia/oci8.setup.html
http://docs.oracle.com/cd/E17390_01/doc.650/e17370.pdf
Found this in the pdf : ( Similar )
If the following error is received:
*ERROR* - obssocookie: could not dlopen()
/opt/netpoint/AccessServerSDK//oblix/lib/libobaccess.so:
/opt/netpoint/AccessServerSDK//oblix/lib/libobaccess.so: wrong ELF class:
ELFCLASS32
This indicates that the 32-bit version of the Access Gate SDK was installed instead of
the required 64-bit version. Edited by: mseberg on Feb 4, 2012 5:53 AM
Still later
Another thought is the PHP forum :
PHP
Also you need the 32bit Instant Client to be able run PHP. See http://blogs.oracle.com/opal/entry/using_php_oci8_with_32-bit_php
Same OS message :
ORA-03106: fatal two-task communication protocol error
Edited by: mseberg on Feb 4, 2012 7:03 PM
Rogue Notes from my Fusion Middleware on Red Hat 5 64 bit
I downloaded php-5.3.5.tar.gz from http://www.php.net/downloads.php.
Download the OCI headers http://www.oracle.com/technetwork/middleware/ias/ociheaders-134541.tar
environment
export ORACLE_HOME=/u01/app/oracle/product/fmw/oracle_pfrd
export ORACLE_INSTANCE=/u01/app/oracle/product/fmw/fr_inst
export CONFIG_FILE_PATH=$ORACLE_INSTANCE/config/OHS/ohs1
export LD_LIBRARY_PATH=$ORACLE_HOME/lib:$ORACLE_HOME/ohs/lib:$LD_LIBRARY_PATH
Configure with Oracle Database (OCI8) support:
./configure with-apxs2=$ORACLE_HOME/ohs/bin/apxs prefix=$ORACLE_HOME with-config-file-path=$CONFIG_FILE_PATH with-oci8=$ORACLE_HOME --disable-rpath
httpd.conf
# And for PHP 5.x use:
AddType application/x-httpd-php .php .phtml
Edited by: mseberg on Feb 4, 2012 7:19 PM
Edited by: mseberg on Feb 5, 2012 11:48 AM

RSA SecurID and Cisco ACS integration for user(s) with enable mode

I thought I had this problem figured out but I guess not.
I have a Cisco 2621 router with IOS 12.2(15)T17. Behind the
router is a Gentoo linux, RSA SecurID 6.1 and Cisco ACS 3.2.
I use tacacs+ authentication for logging into the Cisco router
such as telnet and ssh. In the ACS I use "external user databases"
for authentication which proxy the request from the ACS over
to the RSA SecurID Server. I installed RSA Agents with
sdconf.rec file on the Cisco ACS server. I renamed "user group 1"
to be "RSA_SecurID" group. In the "External user databases" and
"database configurations" I assign SecurID to this "RSA_SecurID"
group.
Everything is working fine. In the "User Setup" I can see dynamic
user test1, test2,...testn listed in there as "dynamic users". In
other words, I can telnet into the router with my two-factor
SecurID.
The problem is that if test1 wants to go into "enable" mode with
SecurID login, I have to go into "test1" user setting and select
"TACACS+Enable Password" and choose "Use external database password".
After that, test1 can go into enable mode with his/her SecurID
credential.
Well, this works fine if I have a few users. The problem is that
I have about 100 users that I need to do this. The solution is
clearly not scalable. Is there a setting from group level that
I can do this?
Any ACS "experts" want to help me out here? Thanks.

That is not what I want. I want user "test1" to be able to do this:
C
Username: test1
Enter PASSCODE:
C2960>en
Enter PASSCODE:
C2960#
In other words, test1 user has to type in his/her RSA token password to get
into exec mode. After that, he/she has to use the RSA token password to
get into enable mode. Each user can get into "enable" mode with his/her
RSA token mode.
The way you descripbed, it seemed like anyone in this group can go directly
into enable mode without password. This is not what I have in mind.
Any other ideas? Thanks.

ASA enable mode with ACS

Hi
When I SSH to my ASA is there anyway to go straight to enable mode? We use RSA SecurID which means I have to wait for the token to change before I go into enable mode at the moment.
ASA config:
aaa authentication ssh console CISCO-ACS LOCAL
aaa authentication serial console CISCO-ACS LOCAL
aaa authentication http console CISCO-ACS LOCAL
aaa authorization command CISCO-ACS LOCAL
aaa accounting enable console CISCO-ACS
aaa accounting serial console CISCO-ACS
aaa accounting ssh console CISCO-ACS
aaa accounting command CISCO-ACS
ACS config (Group Level)
Privilege level 15
Read/write command authorisation set
Thanks

Unfortunately that is not possible as ASA does not support Exec Authorization.
Regards,
~JG
Do rate helpful posts

Show history no longer works above enable mode

Somewhere in the 15.2 train I noticed I could no longer see the command history in global config or any other config mode. It only works in enable mode.
Has anyone else noticed this?
Do I now have to enable show history for config mode?

Hi Jason,
I didn't know so far that the output of "do show history" in config mode shows the config commands too, particulary because the command description only says:
To list the commands you have entered in the current EXEC session, use the show history command in EXEC mode.
But your're right, with my 12.4(21) it does:
R1(config)#do show history int loop0 ip addr 192.168.1.1 255.255.255.0 end
However, if they've changed that behavior somewhere in 15.2, there's a simple alternative:
R1#show run | b ^archivearchive log config logging enable hidekeys!R1#show archive log config all idx sess user@line Logged command 1 3 console@console |interface Loopback0 2 3 console@console | ip address 192.168.1.1 255.255.255.0
That's even better because the archive remains after logoff.
Hope that helps
Rolf

Prime Infrastructure 2.1 - Fetch VLAN Configuration - command failed

Hi,
i am installing the system on a customer's site.
i've noticed that most of the devices configured on the PI have resulted in error in the Configuration Archive with this error:
Fetch VLAN Configuration - command failed.
i checked that the tftp service on the PI is enabled.
i tried manually executing from a device: copy flash:vlan.dat tftp://PI_IP and couldnt manage to do so.
i also tried manually to do it to another tftp server and it worked.
i dont see any FW drops.
does anyone have any idea how to troubleshoot this?
thanks in advance!

As to get the VLAN information, the file in Cisco devices Flash : Vlan.dat is fetced, and if PI fails to do so, it gives this error. As it is a file in flash, PI needs to send it over to Server itself using TFTP.
If TFPT is somehow not working between Server and devices, it may throw this error.
Is it happening with all the devices or some perticular platform?
If with all the device, you need to check if there is any Firewall blocking TFTP access to devices.
Also, you can check if TFTP service on CPI is working properly by command ncs status.
If service is affected, try to restart service - service tftp restart Or you can restart the PI Machine itself.
-Thanks
Vinod
**Encourage Contributors. RATE Them.**

No "configure" command in enable mode?

Similar Messages

Maybe you are looking for