Privilege level

Hi all. I would like to know what are the exact differences between the various privilege levels 0-15 in asa5510. Is there a website that explains this? In my asdm, under aaa access, under authorization tab, under advance button, i can see that there is settings define for level 0,1 and 15. Does it mean i have to define on my own for the other privilege levels? Thks in advance.

Hi Thks for the response. Yes this is what i am looking for. However when i type "show running-config privilege level" only level 3 and 5 show some output as shown below.
FW# show running-config privilege level 5
privilege cmd level 5 mode exec command configure
privilege show level 5 mode exec command running-config
privilege show level 5 mode exec command clock
privilege show level 5 mode exec command fragment
privilege show level 5 mode exec command ntp
privilege show level 5 mode configure command clock
privilege show level 5 mode configure command logging
privilege show level 5 mode configure command fragment
privilege show level 5 mode configure command ntp
privilege show level 5 mode configure command privilege
Whereas level 15 shows nothing. My account in asa5510 is using level 15. Why is this so? Pls advise. Thks in advance.

Similar Messages

Setting privilege level for logging into ASA through ACS

Hi!,
In my environment i implemented AAA for logging into switches, routers, asa etc through ACS which is being configured TACACS+.
I have set different privilege levels like readonly, readwrite etc into ACS. There are working fine when i try to login into switch or router.
But in ASA i am unable to restrict the privilege levels of different users.
Can someone plz guide me with ASA & ACS setting to solve this issue!!!!!

Hi!!
I tried this option. It is working fine with routers & switches. But for ASA privilege access it is not functioning.
I created 3 profiles in "Shared Profiles" & added 1 of them in Group setting & added users to this group with mentioning group authentication. This way i am able to control access to the switches & routers with proper privilege. But the same way when i tried to impolement ASA it's not happening.
Can u plz check it out...

Privilege Levels on FWs, switches and Routers

One question - I am bothered with the privilege level settings.
Is there a default mapping between a priv lvl and teh commands you are allowed to execute or one needs to define that.
EX: I want somebody to only have the right of executing sh run on a device and nothing more.Can this be done?
Thx,
Vlad

I would start by configuring a privilege level and then use the ? to list all the commands available at that level.
privilege level 0 - Includes the disable, enable, exit, help, and logout commands.
privilege level 1 - Normal level on Telnet; includes all user-level commands at the router> prompt.
privilege level 15 - Includes all enable-level commands at the router# prompt.
Commands available at a particular level in a particular router can be found by typing a ? at the router prompt. Commands may be moved between privilege levels by using the privilege command, as illustrated in the example. While this example shows local authentication and authorization, the commands work similarly for TACACS+ or RADIUS authentication and exec authorization (more granularity in control of the router may be achieved with implementation of TACACS+ command authorization with a server.)
Additional details on the users and privilege levels presented in the example:
User six is able to Telnet in and execute the show run command, but the resulting configuration is virtually blank because this user cannot configure anything (configure terminal is at level 8, not at level 6). The user is not permitted to see usernames and passwords of the other users, or to see Simple Network Management Protocol (SNMP) information.
User john is able to Telnet in and execute the show run command, but only sees commands that he can configure (the snmp-server community part of the router configuration, since this user is our network management administrator). He can configure snmp-server community because configure terminal is at level 8 (at or below level 9), and snmp-server community is a level 8 command. The user is not permitted to see usernames and passwords of the other users, but he is trusted with the SNMP configuration.
User inout is able to Telnet in, and, by virtue of being configured for autocommand show running, sees the configuration displayed but is disconnected thereafter.
User poweruser is able to to Telnet in and execute the show run command. This user is at level 15, and is able to see all commands. All commands are at or below level 15; users at this level can also view and control usernames and passwords.
HTH

Aaa radius server control privilege level

I've got radius authentication working on my switch, but I'm trying to allow two types of users login using Windows Active Directory. NetworkUsers who can view configuration and NetworkAdmins who can do anything. I would like for NetworkAdmins to when they login go directly into privilege level 15 but cant get that part to work. Here is my setup:
Windows 2008 R2 Domain controller with NPS installed.
Radius client: I have the IP of the switch along with the key. I have cisco selected under the vendor name in the advance tab
Network Policies:
NetworkAdmins which has the networkadmin group under conditions and under settings i have nothing listed under Standard and for Vendor Specific i have :
Cisco-AV-Pair Cisco shell:priv-lvl=15
My switch config:
aaa new-model
aaa group server radius MTFAAA
server name dc-01
server name dc-02
aaa authentication login NetworkAdmins group MTFAAA local
aaa authorization exec NetworkAdmins group MTFAAA local
radius server dc-01
address ipv4 10.0.1.10 auth-port 1645 acct-port 1646
key 7 ******
radius server dc-02
address ipv4 10.0.1.11 auth-port 1645 acct-port 1646
key 7 ******
No matter what i do it doesnt default to privilege level 15 when i login. Any thoughts

Have you specified the authorization exec group under line vty? I think it is authorization exec command. Something like that.

Privilege level 15 to ASA cli administrator via Radius

Hello Friends!
Is this supported yet on the ASA? I want to be able to have radius assign privilege levels to firewall cli administrators.
Upon login, I'd like them to be immediately be placed into "enabled mode" (without needing to know the local enable password). I believe we can set the maximum privilege level the user can attain. But for now, I simply want to have everyone go into priv level 15 without having to know the shared enable secret password. Switching to tacacs isn't an option.
I remember finding out a while back that this was not possible. Please tell me this is now possible. It's almost 2013.

Thanks Marcin!
Very interesting. Now that you mention it, I do remember seeing someone use the login command after they had already logged in. That's what they must have been doing. I wonder what the thought process was in developing it this way.
I suppose a few different ways around this are (since not everyone will know of this odd behavior and I'm not the only one logging in) to configure radius to authenticate users and then either:
1. Configure a MOTD banner that says "ATTENTION: Type the command 'login', followed by your regular credentials AGAIN to be put into enable mode."
or
2. Configure a MOTD banner that says "ATTENTION: To gain enable mode privileges, type the command 'enable', followed by the password cisco.".
Horrible idea? Thoughts?
// example of the second 'login' command working:
ssh [email protected]
[email protected]'s password:
Warning!
Warning!
Type help or '?' for a list of available commands.
fw1> ?
clear       Reset functions
enable      Turn on privileged commands
exit        Exit from the EXEC
help        Interactive help for commands
login       Log in as a particular user
logout      Exit from the EXEC
no          Negate a command or set its defaults
ping        Send echo messages
quit        Exit from the EXEC
show        Show running system information
traceroute Trace route to destination
fw1> login
Username: admin
Password: *********
fw1#
fw1# sh run username
username admin password encrypted privilege 15

ACS with RSA for privilege level 'enable' authentication

Has anyone experienced problems with privilege level "Enable" password authentication via ACS using RSA two factor authentication? We have recently deployed ACS and use RSA two factor authentication for the telnet connection without any problems. When configuring the networking device and ACS to use RSA for the privelledge level authentication "enable" this fails. We get prompted to enter the token code and the RSA server indicates that authentication is succesful however the network device (ASA or switch) seems to reject it.
Are there any tricks to this?
Thanks in advance!

David
Like Collin the first thing that I think of is that you can not use the same token code to authenticate enable mode that was used to authenticate user mode. Beyond that I am not aware of things that should prevent this working. Are you sure that the ACS authentication server is configured to allow that user access to privilege mode?
Perhaps it would be helpful if you would post the config (especially all the aaa related parts) of a device that is having that problem. And it might help find the issue if you would run debug for authentication, try to login to enable mode, and post the output.
HTH
Rick

Change in privilege level for the command show logging

I have recently discovered a change in behavior in IOS. The command show logging has traditionally been available at user level. Now it has become a privilege level 15 command.
I thought that this was strange and opened a case with Cisco TAC about it. I was told that this is a new "feature" that was implemented for bugid CSCsl61281. Unfortunately this bugid is viewable by Cisco internally but not viewable by the public.
The TAC engineer tells me that this change is integrated into these releases:
This was integrated into the following releases:
12.4(24.05.01)PIX11
12.4(21.14.09)PIC01
12.4(19.03)T
12.2(52.23)SIN
12.2(33)SXI01
12.2(32.08.11)SX229
12.2(32.08.11)SR174
I do not think that this is a good change. If you do not think that this is a good change I suggest that you contact your Cisco support team and express your opinion about this change.
Otherwise as you go to new versions of IOS be aware of the potential impact on your network monitoring processes and procedures that show logging will require level 15 privilege access.
HTH
Rick

Hi Rick,
Can you suggest me references to know more about privilege level commands?
How to enable different commands for different levels of privileges?
Thanks.
-Sudhish

Default Privilege Level for ASA users authenticated by Radius or TACACS when using ASDM

Hello,
I'm trying to figure out what the default privilege level is for users that are authenticated to the ASA via a remote authentication server when using the ASDM.
the command "aaa authentication http console TACACS+ LOCAL" is used in the ASA config.
The remote server is NOT setting any privilege levels for users. There are also no aaa authorization commands present in the config.
So what privilege level do the users receive when they login with the ASDM? I'm being told that the users receive admin access which includes config write, reboot, and debug. But I cannot find any documentation stating hte default level.
Please advise. And providing links to cisco documentation would be great too.
Thanks,
Brendan

Hi Berendan,
Hope the below exerpt from document clarifies your query. also i have provided the link to refer.
About Authorization
Authorization controls access per user after users authenticate. You can configure the security appliance to authorize the following items:
•Management commands
•Network access
•VPN access
Authorization controls the services and commands available to each authenticated user. Were you not to enable authorization, authentication alone would provide the same access to services for all authenticated users.
If you need the control that authorization provides, you can configure a broad authentication rule, and then have a detailed authorization configuration. For example, you authenticate inside users who attempt to access any server on the outside network and then limit the outside servers that a particular user can access using authorization.
The security appliance caches the first 16 authorization requests per user, so if the user accesses the same services during the current authentication session, the security appliance does not resend the request to the authorization server.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/asdm60/user/guide/usrguide/aaasetup.html
Regards
Karthik

RSA SecurID authentication and privilege level

Hello,
I'm new working with Cisco ACS, learning by seat of pants; most of the documentation on Cisco's website is fairly cryptic and does not use many pictures. Therefore,I would appreciate some help setting up privileges. We have ACS v5.2 which I have set up using RSA SecurID and appears to be working correctly. However, I'm having problems with the privilege level when I access a router it lands me in user mode. I'm trying to set up a administrator group for the routers and switches to have each member dropped in privilege level 15, exec mode but I'm having difficulty doing this.
Unfortunately, I'm unable to find any real useful information in reference to setting up RSA SecurID. It seems more of the information is geared around radius servers. Any help would be greatly appreciated. Thank you much!

Hello.
Remember AAA means authentication, authorization and accounting. In your case you authenticate with RSA , but you authorize with ACS policies. For TACACS+ and traditional IOS from routers and switches you can use a ACS policy element called "shell profile" which you can use to specify some attributes like privilege level. Then you can use the "shell profile" to create an authorization policy.
I'm attaching some screenshots. In this example I'm using AD instead of RSA because I don't have a RSA available. Please rate if it helps.

ASDM and privilege level (using TACACS)

Hi experts,
Initial question:     How can I force ASDM to ask for the enable password when the user click on Apply ?
Environment description:
I have an ASA 5510 connected to an ACS 5.0.
Security policy:
I want the user defined on my ACS to be able to gain privilege level 15 but only after using their enable password. But by default the user must be in no privileged mode (<15).
A SNMP alert is sent when the ASA catches a "User priv level changed" syslog message. (logging customization)
ACS configuration:
Maybe I misunderstand the TACACS privilege level parameters on ACS.
I set a Shell Profile which gives the user the following privilege levels:
Default Privilege Level = 7
Maximum Privilege Level = 15
1st config tested on ASA:
aaa authentication ssh console grp-tacacs LOCAL
aaa authentication http console grp-tacacs LOCAL
aaa authentication enable console grp-tacacs LOCAL
! no authorization set
Results:
     On CLI:     perfect
My user authenticates with his network password to get EXEC access. Then he gains privilege access using the enable command and his enable password
     On ASDM:     policy security failure
When the user connects through ASDM, he gains privilege level 15 directly
It seems that if authorization is not set, ASDM always gives privilege level 15 to any user
So OK for CLI, but NOK pour ASDM
2nd config tested on ASA:
aaa authentication ssh console grp-tacacs LOCAL
aaa authentication http console grp-tacacs LOCAL
aaa authentication enable console grp-tacacs LOCAL
aaa authorization exec authentication-server
! no authorization command set
Results:
     On CLI:     lose enable access
I can't gain privilege level 15 access anymore. When I use the enable command, I move to privilege level 7 only. So in this case ASA use the TACACS Default Privilege Level value.
     On ASDM:     policy security failure
When the user connects through ASDM, he gains privilege level 7 as describe on the bottom of the ASDM window BUT the user has full rights and can change settings.
So NOK for CLI and ASDM
Question:    Why do I have more access rights with ASDM as on CLI with the same settings ?
3rd config tested on ASA:
aaa authentication ssh console grp-tacacs LOCAL
aaa authentication http console grp-tacacs LOCAL
aaa authentication enable console grp-tacacs LOCAL
aaa authorization exec authentication-server
aaa authorization command LOCAL
! specific authorization command set for ASDM applied
Results:
     On CLI:     lose enable access (same as config 2)
     On ASDM:     unenable to gain privilege level 15 --> acceptable
When the user connects through ASDM, he gains privilege level 7 as describe on the bottom of the ASDM window AND the user really has level 7 access rights.
So NOK for CLI and Acceptable for ASDM
Question:     Is there no possibility to move to enable mode on ASDM ?
4th config tested on ASA:
aaa authentication ssh console grp-tacacs LOCAL
aaa authentication http console grp-tacacs LOCAL
aaa authorization exec authentication-server
aaa authorization command LOCAL
! no aaa authentication for 'enable access', using local enable_15 account
! specific authorization command set for ASDM applied
Results:
     On CLI:     acceptable
My user authenticates with his network password to get EXEC access. Then he gains privilege access using the enable command and the local enable password
     On ASDM:     unenable to gain privilege level 15 --> acceptable (same as config 3)
So Acceptable for CLI and ASDM
Questions review:
1 - Is it possible to force ASDM to ask for the enable password when the user click on Apply ?
2 - Why do I have different access rights using ASDM as on CLI with the same settings ?
3 - Is there no possibility to move to enable mode on ASDM when the user is on privilege level 7 whereas he has Maximum Privilege Level = 15 ?
4 - How may I understand these parameters on TACACS: Default Privilege Level and Maximum Privilege Level ?
Thanks for your help.

Thanks for your answer jedubois.
In fact, my security policy is like this:
A) Authentication has to be nominative with password enforcement policy
     --> I'm using CS ACS v5.1 appliance with local user database on it
B) Every "network" user can be granted priviledge level 15
     --> max user priviledged level is set to 15 in my authentication mechanism on ACS
C) A "network" user can log onto the network equipments (RTR, SW and FW) but having monitor access only first.
D) A "network" user can be granted priviledged level 15 after a second authentication which generates a log message
     --> SNMP trap sent to supervision server
E) The user password and enable password have to be personal.
So, I need only 2 priviledged level:
- monitor (any level from 1 to 14. I set 7)
- admin (level 15)
For RTR, SW and FW (on CLI), it works as wanted: the "network" users connect to the equipment in monitor mode. They type "enable" and they use their private enable password to be granted priviledged level 15.
ASDM interface is requested by the customer.
For ASDM, as I were not able to satisfy the security policy, I apply this:
1- I activated Exec Shell Access authorization to get the default user priviledge level value from ACS
     --> Then, when I log onto the ASDM using a "network" user, I have priviledge level 7 but I am able to change the parameter.
2- I activated LOCAL Command authorization (adding "ASDM defined User Roles")
     --> Then, when I log onto the ASDM using a "network" user, I have priviledge level 7 and I can't push any modification.
     --> The issue is that I can't push any modification on CLI either ... :-( because my user is stuck on "default priviledge level" 7 and can't get access to "max priviledge level 15" as defined on ACS when LOCAL authorization is set
     (ok I go on my ACS and move the default priviledge level to 15 to restore an admin access to the ASA and apply 3- before resetting it to default priviledge level to 7)
3- I remove "aaa authorization enable console TACACS" to use local enable password
     --> now I can't get admin access on ASDM: OK
     --> and I can get admin access on CLI entering the local enable password
At the end, I satisfy my policy security tokens A to D but not E. That's a good compromise but do you see a solution to satisfy E either ?
Thanks

Create a privilege level that only allows access to show commands

Hi,
I would like to create a privilege level that would only give access to the show commands for certain users. What would be the best way to do this?
Would I have to use the privilege mode level level command for every available show command or is there a more efficient way of doing this?
In addition, could we manage such a privilege level from a Radius Server.
Thanks for your help
Stéphane

Well, I think the best way to achive this is to use TACACS with command authorization feature.
Configuration on the tacacs server ( only for show commands, read only access)
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml#scenario2
These commands are required on an IOS router or switch in order to implement command authorization through an ACS server:
    aaa new-model
    aaa authorization config-commands
    aaa authorization commands 0 default group tacacs+ local
    aaa authorization commands 1 default group tacacs+ local
    aaa authorization commands 15 default group tacacs+ local
     tacacs-server host 10.1.1.1
     tacacs-server key cisco123
These commands are required on ASA/PIX/FWSM in order to implement command authorization through an ACS server:
    aaa-server authserver protocol tacacs+
    aaa-server authserver host 10.1.1.1
    aaa authorization command authserver
However, if you strictly want to use radius server then please try the below listed attribute for a single user or group.
Service-Type = NAS Prompt
http://www.ietf.org/assignments/radius-types/radius-types.xml#radius-types-4
This might not work for ASDM.
HTH
Regards,
Jatin
Do rate helpful posts-

Username with privilege level 15 bypass enable

Hi experts,
I guess I never really understand the authentication process on Cisco routers and devices lol. Anyway I want users with privilege level 15 to be put in the enable mode right away after login without having to type in "enable" command and enable password. Users with other privilege levels will still be put in the EXEC mode.
AAA has to be enabled because I'm using it for 802.1x as well.
The privilege level eventually will be assigned by Radius server but right now the user is created locally on the switch. Right now I have:
aaa new-model
username admin privilege 15 secret 5 $1$2bdl$VIp53G4/zpo4f9aHh.t5v0
username cisco secret 5 $1$NGdD$ehTUzwappJFMxgA7tM/YW.
line vty 0 5
access-class 100 in
exec-timeout 30 0
logging synchronous
transport input ssh
And it's not working lol. No matter I log in with "admin" or "cisco" I'm put in EXEC mode... What do I have to do to achieve this?
Thanks!

Hi,
The with default keyword authorization will get applied on all the lines i.e. CONSOLE, VTY, AUX.
In case you want it for users who are trying to login to via ssh or telnet use the following:
EXEC AUTHORIZATION
Router
router(config)#aaa authorization exec TEL GRoup radius local
router(config)#line vty 0 15
router(config-line)#authorization exec TEL
ACS
Interface configuration
Check user & group for cisco av-pair.
User setup à cisco ios/pix 6.x radius attributes àcisco av-pair [ shell:priv-lvl=15]
OR
Group setup à ios/pix 6.x radius attributes à shell:priv-lvl=15
In case of radius if exec authorization is enabled and if have not specified any privilege level in the ACS server. Then user will fall under the privilege level 1 and if enable authentication is enabled or enable password is defined on the router then we can go to enable mode by typing en or en
Regards,
Anisha
P.S.: please mark this thread as resolved if you think your query is answered.

Enable aaa accounting commands for all privilege levels?

Here is the command's syntax:
aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} {start-stop | stop-only | none} [broadcast] group groupname
The "command" accounting type must include the privilege level of the commands you are logging. How do I log ALL commands?
Take the following example:
aaa accounting commands 15 default start-stop group mygroup
If I issue this command will that mean commands the user executes that have a privilege level lower than 15 will not be logged? Or only commands that require exactly privilege level 15 will be logged?
How can I log all commands regardless of privilege level?

Hi Red,
If you customize the command privilege level using the privilege command, you can limit which commands the appliance accounts for by specifying a minimum privilege level. The security appliance does not account for commands that are below the minimum privilege level.
The default privilege level is 0. So if you don't specify any privilege level then all should be accounted for.
You can find the command detail at. This is for ASA though.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/command/reference/cmd_ref/a1.html#wp1535253
Regards,
Kanwal
Note: Please mark answers if they are helpful.

Enabling Privilege Levels when ACS is Down

Hi,
I have a requirement to fall back to local accounts when ACS is down. These accounts will have specific privilege levels. I have two local users - adminro and adminrw.
adminro is read only and will have a privilege level of 7.
adminrw is a full access account with a priv level of 15.
I can login with adminro when ACS is down, but when I attempt to enable using "enable 7" I receive the following ouput:
PPD-ELPUF5/pri/act> en 7
Enabling to privilege levels is not allowed when configured for
AAA authentication. Use 'enable' only.
If I login using "enable", my read only account now has full configuration access which is not desireable.
My AAA configuration is as follows:
aaa authentication ssh console ADMIN LOCAL
aaa authentication enable console ADMIN LOCAL
aaa authentication http console ADMIN LOCAL
aaa authentication telnet console ADMIN LOCAL
aaa authentication serial console ADMIN LOCAL
aaa authorization command ADMIN LOCAL
aaa accounting ssh console ADMIN
aaa accounting command privilege 15 ADMIN
aaa accounting enable console ADMIN
aaa accounting serial console ADMIN
aaa accounting telnet console ADMIN
aaa authorization exec authentication-server
username adminro password <REMOVED> encrypted privilege 7
username adminrw password <REMOVED> encrypted privilege 15
enable password <REMOVED> level 7 encrypted
enable password <REMOVED> encrypted
Is there anyway to enable the user or automatically elevate the user to privilege 7 post login like you can with a router? I cannot have the adminro account to be able to run configuration commands on the device. Running ASA version 8.2(3).
Thanks!

PPD-ELPUF5/pri/act# sh curpriv
Username : adminro
Current privilege level : 7
Current Mode/s : P_PRIV
Server Group:    ADMIN
Server Protocol: tacacs+
Server Address: 1.150.1.80
Server port:     49
Server status:   FAILED, Server disabled at 15:02:37 EDT Wed Oct 12 2011
Number of pending requests              0
Average round trip time                 2ms
Number of authentication requests       38
Number of authorization requests        373
Number of accounting requests           149
Number of retransmissions               0
Number of accepts                       307
Number of rejects                       19
Number of challenges                    0
Number of malformed responses           0
Number of bad authenticators            0
Number of timeouts                      234
Number of unrecognized responses        0
PPD-ELPUF5/pri/act(config)# name 1.1.1.1 TEST description TEST CHANGE
PPD-ELPUF5/pri/act(config)# sh run name
name 1.1.1.1 TEST description TEST CHANGE
As you can see above, my user was able to perform a change even though it should not be allowed.
PPD-ELPUF5/pri/act(config)# sh run privilege
privilege cmd level 7 mode exec command show
privilege cmd level 7 mode exec command ping
privilege cmd level 7 mode exec command traceroute

Ise and switch authentication and privilege level

Hi Guys,
I'm working on an eval on vmware. I have got everything working for wlan authentication and I’m working on shell authentication for switches. On the ACS you have the possibility to give the user privilege level on the switch. You can do this with shell profiles in ACS.
Is there a way to get this done in ISE? I was thinking to make a result policy elements but I can't find a shell profile or privilege attributes like in ACS.
For the record, switch authentication is working with Active Directory. I only need to know how to give the right return attribute.
I appreciate any help!
Sander

@Sander,
You were in the right area.
Policy->Results->Authorization->Authorization Profiles.
Create AuthZ profile for Access-Accept and Under the Advanced Attributes Settings you can use:
Cisco:cisco-av-pair = shell:priv-lvl=15
or whatever privilege level you want to assign.
On your AuthZ rule, match the conditions and apply the created profile.

Assigning privilege level using Radius

I'm trying to assigned a privilege level on a Cisco router via Radius. I'm using the Cisco Secure ACS (Windows 2K).
I have set the privilege level to 15. But when I telnet to the router, I always get the router> prompt instead of the router# prompt.
How can I configured the Radius/router so that when I get successfully authenticated, the router# prompt is shown.
I've configured the router as below:
aaa authentication login vtymethod group radius enable
aaa authorization exec vtymethod group radius local
radius-server host 202.x.x.195 auth-port 1645 acct-port 1646 key cisco
line vty 0 4
authorization exec vtymethod
login authentication vtymethod
On the Radius, I've configured as below:
In the group settings for IETF Radius attributes, the Service-Type is set to Nas Prompt.
Also in the group settings, I've checked the Cisco-av-pair with the following configured: shell:priv-lvl=15.
Is there something I'm missing.
Appreciate the help.
Thanks.
sweeann

Hi
Im curious... what is the perceived benefit of using RADIUS instead of TACACS+ ?
Given that ACS supports both and that T+ is a superior protocol for device admin.
I once heard someone mutter that T+ was proprietry... but all they were doing was sending (effectively) T+ av-pairs via a Cisco RADIUS VSAs. Not significantly different one could argue!

Privilege level

Similar Messages

Maybe you are looking for