We configure AAA on router for the Telnet/SSH access. We activate HTTP on our router to our provisioning tool. The provisioning tool needs to retrieve information and execute some command on the HTTP page. The HTTP authentication on the router is local (so the prov. tool have a local account), but to execute some commands, he needs to request the authorization to a TACACS server.

Below is the configurations for aaa and ip http server:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ none 
aaa authorization commands 15 default group tacacs+ none 
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+ 
username prov_tool privilege 15 password pwd
! http config. 
ip http server
ip http access-class 2
ip http authentication local

I would like to know if there is a way for the provision tool to be locally authenticated and authorized to execute any command.

  • 3
    Have you considered creating a TACACS account for your provisioning tool? That way, you can control (and log) its actions. – Ron Trunk Jan 14 '14 at 16:29
  • 1
    Ron is right, you can even use an open-source TACACS solution if you're strapped for cash. – Ryan Foley Jan 14 '14 at 16:49
  • Well the issue, it's the network is on our own premise and responsability and the provisioning tool is external and manage by another company. – cgasp Jan 14 '14 at 18:32
  • Actually the Prov. Tools have tacacs account but we want to avoid it. – cgasp Jan 14 '14 at 18:42
  • 1
    If the provisioning tool is external, IMO that is even more reason to use TACACS. You will want to control and log what the provisioning tool does, so if there's a mistake, you can quickly find out what it is. Also, you can limit the tool to just those things its supposed to change, and not change other things (like passwords, for instance). – Ron Trunk Jan 14 '14 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.