On Tue, 2013-06-04 at 21:01 -0700, George Hong wrote: > My tacacs config should fall back to local authorization but that doesn't > seem to work.
Apart from "if-authenticated" as Nick mentioned you might consider using different AAA methods for the different lines. We have a method with local authentication and no authorization for console access. Something like this: aaa authentication login AAA-CONSOLE local-case aaa authorization exec AAA-CONSOLE none ! aaa authentication login AAA-VTY group tacacs+ local aaa authorization exec AAA-VTY group tacacs+ if-authenticated aaa authorization commands 0 AAA-VTY group tacacs+ if-authenticated aaa authorization commands 15 AAA-VTY group tacacs+ if-authenticated aaa authorization config-commands ! line con 0 login authentication AAA-CONSOLE ! line vty 0 15 authorization commands 0 AAA-VTY authorization commands 15 AAA-VTY authorization exec AAA-VTY login authentication AAA-VTY ! I'm not sure why "local" doesn't work in your case though. Intuitively it does seem to be the right thing for what you probably want. We chose no authorization since console probably equals local access, which makes it rather easy to make the TACACS+ server unreachable anyway. -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
