Cisco MDS 9000 Series Configuration Manual page 54

Configuring Role-based Authorization on TACACS+ Server
Figure 3: Switch Authorization and Authentication Flow
Note No more server groups left = no response from any server in all server groups.No more servers left = no
response from any server within this server group.
To configure role-based authorization on TACACS+ server, follow these steps:
Procedure
Step 1 switch# configure terminal
Enters configuration mode.
Step 2
switch(config)# aaa authorization
Enables configuration of authorization methods.
Step 3 switch(config)# aaa authorization config-commands
Enables authorization for all commands under config mode Layer2 and Layer3.
Step 4 switch(config)# aaa authorization config-commands default group tac1
Enables specified TACACS+ server group authorization.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
36
Configuring Security Features on an External AAA Server