simple answer
Its NOT possible to assign priv level on PIX/ASAm you still have to type
in "enable".
there is no such thing like exec authorization via aaa in the OS of the
firewalls. It´s only possible in CATOS/IOS/NX-OS
Am 19.11.2010 15:29, schrieb David White, Jr. (dwhitejr):
Hi Edward,
It sounds like you are missing the following line in your configuration:
aaa authorization exec authentication-server
Issue "show curpriv" after the user logs in to verify they are assigned
the correct privilege level from the Radius server.
Sincerely,
David.
Edward Iong wrote:
Dear All,
We have encouter an issue as we Assign Privilege Levels in PIX or ASA with
Microsoft IAS server.
We plan to set RO and RW access for users to have different privilege levels to
access Cisco devices.
We have tested that Switch and Router does not have the RO(router>)non-privilege level
issue. But in ASA/PIX using user account which is in the RO group which has set
"shell:priv-lvl=1 or 5" can access the privilege mode (prompt is router#)
itestmo is a RO group
> From PIX or ASA.
"
Username: ittestmo
Password: *******
Type help or '?' for a list of available commands.
MOOFFW01> EN
Password: *******
MOOFFW01#
"
> From Switch or router
"
User Access Verification
Username: ittestmo
Password:
MOOFSW01>EN
Password:
% Access denied
MOOFSW01>
"
Could anyone let me know how to use this issue?
Thanks and Regards,
Edward
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
