Can anyone help me with understanding one thing about AAA authorization on Cisco IOS. Here is a config fragment:

aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+
aaa authorization commands 15 default group tacacs+ local

Do I understand correctly that authorization allows some commands (like "commands 15") for some users (like "group tacacs+")? So why there is no option "group" for the config-commands?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5 at 1:29

From CCO docs

If aaa authorization commands level method command is enabled, all commands, including configuration commands, are authorized by AAA using the method specified. Because there are configuration commands that are identical to some EXEC-level commands, there can be some confusion in the authorization process. Using the no aaa authorization config-commands command stops the network access server from attempting configuration command authorization.

It never really occurred to me, but the way you suggest would make more sense than the way it works. Now it just inherits the server which it should query from 'commands level' and documents are unclear which level, as they may be different, but I guess it would be level 15.


What the last line in your example config does is require level 15 commands to be authorized through tacacs+, or if tacacs+ is not available, to utilize the local database. The previous line requires authorization of level 1 commands through tacacs+ only.

It has nothing to do with specifying groups of users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.