I have a following very minimalistic AAA configuration in ISR router with IOS 12.4(22)T:

aaa new-model
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ 
aaa session-id common

After authentication I end up in privilege level 15. Now if execute commands like conf t or show ver, the router does not consult with TACACS+ server(I run a packet capture on TACACS+ server TCP port 49). What exactly the aaa authorization exec default group tacacs+ does? When does the command authorization happen?

  • 2
    By minimalistic, you mean that you haven't really got a tacacs+ server configured? You have to tell ios where the server is, there isn't a magic find the server function in ios Apr 6, 2015 at 15:01
  • Sorry, I didn't mention this in my initial post. TACACS+ server is configured with tacacs-server host key passwd command.
    – Martin
    Apr 7, 2015 at 7:01
  • 1
    Command authorization uses the aaa authorization commands ... syntax.
    – cpt_fink
    Apr 12, 2015 at 22:22

3 Answers 3


The statement

aaa authorization exec default group tacacs+

allows you to start a CLI session (a command shell). Without it, you can't get a command prompt.

You can see more information here.

EDIT: From: http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#wp1058237

AAA Authorization Types

Cisco IOS software supports five different types of authorization: •Auth-proxy—Applies specific security policies on a per-user basis. See "Related Documents" section for more information about where to find authentication proxy configuration documentation.

•Commands—Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.

•EXEC—Applies to the attributes associated with a user EXEC terminal session.

•Network—Applies to network connections. This can include a PPP, SLIP, or ARAP connection.

•Reverse Access—Applies to reverse Telnet sessions.

•Configuration—Applies to downloading configurations from the AAA server.

•IP Mobile—Applies to authorization for IP mobile services.

I think the confusion comes from the difference in how different TACACS daemons respond. Cisco ACS may respond differently than your Shrubbery daemon or tacacs.net.

Here is some more reference material, although not exactly what you're asking for: TACACS Attribute-Value Pairs

  • Actually you will get a command prompt without the aaa authorization exec default group tacacs+ command. All one needs is aaa new-model, aaa authentication login default group tacacs+ enable and tacacs-server host key passwd.
    – Martin
    Apr 7, 2015 at 7:10
  • What ios version are you running?
    – Ron Trunk
    Apr 7, 2015 at 10:16
  • As I mentioned in my initial post, I'm running IOS 12.4(22)T(c1841-spservicesk9-mz.124-22.T.bin).
    – Martin
    Apr 7, 2015 at 13:00

It seems to me that aaa authorization exec default group tacacs+ command forces TACACS+ client(Cisco ISR router in my case) to take account the service = exec configuration snippet in TACACS+ daemon(tac_plus from http://www.shrubbery.net/tac_plus/) configuration file. For example:

service = exec {
  priv-lvl = 15
  autocmd = "show version"

If I remove the aaa authorization exec default group tacacs+ command I end up in IOS shell in privilege level 1 and show version is not automatically executed. However, I would like to have an authoritative answer and does this command have any other purpose?


aaa authorization exec default group tacacs+


aaa authorization {auth-proxy | network | exec | commands level | reverse-access | configuration | ipmobile} {default | list-name} [method1 [method2]]

AAA authorization controls the user's activity by permitting or denying access to what type of network access a user can start (PPP, SLIP, ARAP), what type of commands the user can execute, and more.

exec - Applies to a user EXEC terminal session.

default - Uses the listed authentication methods that follow this argument as the default list of methods for authorization.

list-name - Character string used to name the list of authentication methods.

method - Specifies at least one of the keywords that follow.

group / group-name - Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.