5 votes
Accepted

AAA authentication for all users and a single user for local only?

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password ...
Ron Trunk's user avatar
  • 67.5k
4 votes
Accepted

Cisco 2960 radius configuration

This line: aaa authorization exec default local Doesn't allow you to start a shell (Exec) with Radius credentials. You should change it to: aaa authorization exec default group radius local
Ron Trunk's user avatar
  • 67.5k
4 votes
Accepted

AAA Authorization on IOS

Edited: You use the group tacacs+ for your authentication, but you have not configured a server group for that. Here is a corrected configuration: aaa authentication login default group HQTACACS ...
Ron Trunk's user avatar
  • 67.5k
4 votes

TACACS+ AAA over L2L VPN

Your configuration aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10 key testing123 defines the inside interface as the source.
Ron Trunk's user avatar
  • 67.5k
4 votes
Accepted

TACACS+ AAA over L2L VPN

In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA ...
Jesse P.'s user avatar
  • 4,690
3 votes
Accepted

Tacacs+ over VPN is not working

You need it to source from the inside interface to be included in the interesting traffic over a tunnel. Without specifying that, it will take your default route to get there, which would be your ...
Jesse P.'s user avatar
  • 4,690
3 votes

AAA authentication - Explanation of how each AAA command works

The line aaa authentication login console local group TACACS+ is telling any protocol using “console” as the authentication group (list of servers to authenticate against) to use local authentication ...
Jesse P.'s user avatar
  • 4,690
3 votes

What's the difference between DIAMETER and 802.1X Authentication?

802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication ...
Zac67's user avatar
  • 84.4k
3 votes
Accepted

How can I get a list of users and last login dates from a Cisco ACS running v5.2?

According to the Cisco TAC representative who handled my case, there is no way to get a list of users that includes their last login date, with the possible exception of looking up each user ...
user3573647's user avatar
3 votes
Accepted

What was the AAA "old-model"?

Basically, the old model was just Authentication with little Authorization and no real Accounting. Maybe you just call it A instead of AAA. :) Searching the Internet has turned up a few references: ...
Ron Maupin's user avatar
  • 99.6k
2 votes

AAA Authorization

Define the local group for the secondary AAA method for authorization, that way if the servers are down it'll use the local priv level for the user account (make sure it's set to 15 for full access) ...
Fallacy11's user avatar
  • 566
2 votes
Accepted

802.1X for Wi-FI

To answer your first question, Yes someone with a wireless sniffer will be able to find your "hidden" SSID by examining probe requests from clients that are already configured to connect to that SSID. ...
Neil Johnson's user avatar
2 votes

Authentication error

After reviewing your configuration it appears that you applied login local only the VTY lines and not the console port. Since you no longer have access to the device you will need to initate a ...
Zack Scaringello's user avatar
2 votes
Accepted

AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?

If you are using 802.1x on a cisco switch, you can configure the interface to fallback to an authorized vlan if the server is dead. authentication event server dead action authorize vlan XX ...
John K.'s user avatar
  • 969
2 votes

What does aaa mean?

That stands for Authentication, Authorization, and Accounting. It controls who is authorized on a device, what authorization each has, and accounting of who is doing what. Cisco has documents, e.g. ...
Ron Maupin's user avatar
  • 99.6k
2 votes
Accepted

Lockout of console! Help required!

Cisco maintains a page with links to the password recovery procedures for a lot of devices: Password Recovery Procedures You will need to restart the switch to get to ROMMON in order to recover the ...
Ron Maupin's user avatar
  • 99.6k
2 votes
Accepted

Where did `private_sg-0` come from?

You have't gone wrong. That's the expected output for an IOS device configured for local authentication. The "private_sg-0" just means it's a server group local to the device. I'm not 100% clear on ...
rnxrx's user avatar
  • 6,114
2 votes
Accepted

How to Multiple Radius server in ASA

You can add the second server to the "SecureID" Server Group as well: aaa-server SecureID (inside) host 10.1.1.2 key ***** authentication-port 1812 accounting-port 1813 Because both AAA Server in ...
scherard's user avatar
  • 164
2 votes
Accepted

Cisco ISE and WLC 802.1x Non-Dynamic VLAN Placement

Looking through the configuration I now see the problem. It was also hinted at in the screenshots you provided, but I missed it until I saw it in your configuration. WLAN 1, your normal production ...
YLearn's user avatar
  • 27.3k
2 votes

AAA authentication for all users and a single user for local only?

This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens): aaa authentication login default local ...
Todd Wilcox's user avatar
  • 1,135
2 votes

Limit Access to a Specific VRF?

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's ...
Ron Trunk's user avatar
  • 67.5k
1 vote
Accepted

Privileged Identity Management for switch users' account

Yes. It is possible. You need to use RADIUS or tacacs+ Server. Its are centralized Authentication servers such as active directory. Radius server is available in windows Server environment as well. ...
infra's user avatar
  • 3,118
1 vote

Cisco Mobility Express - supported authentication options

If you mean host to network attachment, then it works much like any other Cisco wireless products using WPA2 Personal (Pre-Shared Key) or WPA2 Enterprise (802.1X using RADIUS). If you mean logging ...
Ron Maupin's user avatar
  • 99.6k
1 vote
Accepted

AAA Radius Privilege levels

The "enable" command is a level 1 command. If you don't want your users to execute it, the simplest way is not to give them the password. Alternatively, you can configure command authorization, but ...
Ron Trunk's user avatar
  • 67.5k
1 vote
Accepted

Cisco 3750 switch not communicating with RADIUS server

Finally got it - the problem was that PacketFence iptables rules were set for RADIUS traffic from management interface, but I had to send it from another one. So adding some iptables rules made it ...
Jesse_Pinkman's user avatar
1 vote
Accepted

Is every Switch capable of Network Access Server?

No, not all switches support it. As you may have learned already this is part of the IEEE 802.1x standard , so the devices that support it are those who list 802.1X as a supported feature.
JFL's user avatar
  • 19.6k
1 vote

Can I limit Cisco IOS login to specific users?

You could set a diffrent password for telnet access and console access. First set the users with the privileges you want them to have. To set a telnet password (if 15 doesn't work put highest ...
Fixitrod's user avatar
  • 938
1 vote

Can I limit Cisco IOS login to specific users?

For console physical access control, easiest would just be to use local user logins and then SSH would still reference TACACS: username test privilege 15 secret test ! aaa authentication login ...
cmschmidt15's user avatar
1 vote

cisco ssh key authorization level via radius

If the radius server supports cisco av-pair attributes then you can configure it to push: cisco-avpair =shell:priv-lvl=15 Note that this requires authorization to be enabled in addition to ...
hertitu's user avatar
  • 2,648
1 vote

Limit Access to a Specific VRF?

Just to close this out, I worked with Cisco support to configure ACS to limit their access as much as possible but they did confirm that you cannot limit access to a VRF. I also asked them if I could ...
RSS's user avatar
  • 210

Only top scored, non community-wiki answers of a minimum length are eligible