I have two routers: Cisco ISR 2921 with IOS version 15.0(1r)M9 and a Cisco C2600 which is an old guy with IOS 12.0(7)XK1.
I have this set up on a FreeRADIUS server:
router-admin MD5-Password := "<MD5-Digested-Password>"
Service-Type = NAS-Prompt-User,
Cisco-AVPair += "shell:priv-lvl=15"
I have set up the following config on both of the routers:
aaa new-model
aaa authentication login default group radius local
The ISR 2921, when you authenticate, gives you 15th level of privilege (# shell) at once, but the C2600 gives a user mode (> shell). Why would this happen? Maybe the IOS doesn't support that option yet or do I have to do some additional configuration?
Update:
Actually one more thing that's different is C2600 runs telnet (because it doesn't support SSH) and 2921 runs SSH.
VTY section from 2921:
line vty 0 4
access-class 50 in
exec-timeout 5 0
logging synchronous
length 0
transport input ssh
line vty 5 30
access-class 50 in
exec-timeout 5 0
logging synchronous
transport input ssh
!
AAA section from 2921:
aaa new-model
aaa authentication login default group radius local
aaa authentication login IPSEC-USERS group radius
aaa authorization exec default group radius local
aaa authorization network IPSEC-USERS group radius
aaa accounting delay-start
aaa accounting update periodic 10
aaa accounting exec default
group radius
aaa accounting network IPSEC-USERS
group radius
aaa accounting system default
group radius
aaa session-id unique
radius-server host 192.168.5.55 auth-port 1812 acct-port 1813
radius-server key 7 <KEY>
VTY section from C2600:
line vty 0 4
password 7 <pw>
!
AAA section from C2600:
aaa new-model
aaa authentication login default group radius local
aaa authorization network default group radius local
aaa accounting exec default start-stop group radius
aaa accounting commands 15 default stop-only group radius
aaa accounting network default start-stop group radius
aaa accounting system default start-stop group radius
