4

I configured aaa using Tacacs+ on a switch and a router but when I try to connect to the switch through SSH it just accept Tacacs+ users when I try to use local DB user I got "% Authorization failed."

following are the aaa configuration:

aaa new-model

aaa authentication login default local

aaa authorization exec default group tacacs+ local

aaa authorization commands 15 default group tacacs+

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

Improve this question
2
  • Note: I've seen different AAA behavior between platforms and IOS releases. A setup that works on one platform+version may not work on a different one.
    – Ricky
    Mar 19, 2015 at 18:50
  • You are right Ricky. I lost some marks on a lab exam because of that :(
    – user1011891
    Mar 19, 2015 at 23:14

1 Answer 1

Reset to default
5

You are authenticating correctly, but the command 

aaa authorization exec default group tacacs+ local

means that in order to start an exec sesion (i.e. a command line shell), the switch will check the Tacacs server for your credentials. Since presumably they're not there, the authorization is failing. It will only use the local database when the Tacacs server is unavailable.

A helpful tip: If you have (read) access to the Tacacs server, check the "failed attempts" log or the Tacacs Events log (depending on the ACS version). It will tell you why the event failed, so you can go fix it.

Improve this answer
3
  • It fails because the local users don't exist (or have different passwords) on TACACS. Put local first if you want local users to override tacacs. However, his commands 15 rule will prevent local users from running priv commands.
    – Ricky
    Mar 19, 2015 at 18:48
  • Thanks for your clarification Ron. You are right I found the message "22056 Subject not found in the applicable identity store(s)." in the ACS failed attempts log. In this case what is the use for "the parameter "local"in the command? and if I change the order to be >aaa authorization exec default local group tacacs+ will the switch check the local DB only?
    – user1011891
    Mar 19, 2015 at 19:55
  • 1
    In your case, the device will use the TACACS database. It will use the local database ONLY if TACACS is unavailable. If TACACS doesn't have the user in the database, it will issue a "Reject" message, and the switch/router will stop processing -- it won't try the local database.
    – Ron Trunk
    Mar 19, 2015 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.