tacacs+, get rid of enable

Try this:

aaa authorization exec default group tacacs+ if-authenticated

Jim

Thanks Jim.

I did try this command, but it prevents logging in altogether unless I disable the tacacs-server connection. Problem is that I'm getting the User Exec prompt and having to issue the "enable" command before tacacs+ asks me for my login/password - so I am not actually authenticated yet?

I know what I am actually -- Baffled! I'll keep pluggin' away at it and if I figure it out I'll post it.

John

I haven't seen that before. But, then again, I don't normally have these commands in there either:

perhaps one of them is getting in the way.

I just usually do:

aaa new-model aaa authentication login default local group radius aaa-authorization exec default local group radius if-authenticated

That's pretty much all that is needed, at least for radius. Not sure about tacacs.

Jim

Hi

you need to return 'priv-lvl = 15' from the tacacs server

also required -

aaa new-model aaa authentication login default group tacacs+ none aaa authorization exec default group tacacs+ if-authenticated

Carl