1

After configuring Tacacs+ cannot access throught tacacs or telnet:

aaa new-model
!
!
aaa group server tacacs+ TACACS+CG
 server [server ip address]
 server [server ip address]
!
aaa authentication login default group TACACS+CG enable
aaa authentication enable default group TACACS+CG enable
aaa authorization exec default group TACACS+CG if-authenticated 
aaa authorization commands 0 default group TACACS+CG if-authenticated 
aaa authorization commands 1 default group TACACS+CG if-authenticated 
aaa authorization commands 15 default group TACACS+CG if-authenticated 
!
aaa session-id common
!
tacacs-server host [server ip address] timeout 3 key 7 [key]
tacacs-server host [server ip address] timeout 3 key 7 [key]
!

What am i doing wrong? help is appreciated.

4
  • 1
    What are you using as a TACACS+ server? How is it configured? Do you have any devices authenticating to it successfully? – YLearn Jun 30 '15 at 22:23
  • How are the vty lines configured? console? – Ricky Jun 30 '15 at 23:22
  • Look at the TACACS server log. It will tell you why it is rejecting your CLI commands – Ron Trunk Jul 1 '15 at 2:27
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 3:24
1

The instant you enter aaa authorization commands, TACACS applies to every command you enter. If you aren't authenticated by TACACS, you will be unable to do anything. If the tacacs server(s) aren't reachable, there can be significant delays for each command as it tries to authorize them.

2
  • When i connect to the router through the managment interface it does not ask for username. Instead it ask for a password only. But when i insert the password configurated for vty it says wrong password – Gngogh Jun 30 '15 at 23:59
  • 1
    What "management interface"? serial console ("con") or telnet ("vty")? They have independent configurations. – Ricky Jul 1 '15 at 0:02
0

It will not let me add a comment to the above answer. :( What Ricky has posted is correct. Does your enable password work for the login? You do have that set as the backup for your login in the configuration above.

I have seen this more than once in my time. The best advice that I can give you is to do the following two things in the future.

Add "local" to the end of your AAA commands

aaa authentication login default group TACACS+CG enable local

Do not add the AAA authorization commands until you know that the more basic items are functioning properly.

Let us know about the enable password. You should be able to access your configuration at that point.

Daniel

0

To be able to debug allow local login, then login and observe with debug tacacs what is happening when you log in with a tacacs login id on second telnet session.

Paste into config after saving original.

!    
username test privilege 15 password test
!
aaa authentication login default local group TACACS+CG enable
no aaa authentication enable default group TACACS+CG enable
aaa authorization exec default if-authenticated 
aaa authorization commands 0 default  if-authenticated 
aaa authorization commands 1 default  if-authenticated 
aaa authorization commands 15 default  if-authenticated
!

after logging in as test user

!
debug tacacs
terminal monitor
!

then try and login using a tacacs account on second telnet session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.