Configuring Tacacs+ Authorization For Privileged Exec Access And Network Services - Cisco 2950 - Catalyst Switch Configuration Manual

Controlling Switch Access with TACACS+
To disable AAA, use the no aaa new-model global configuration command. To disable AAA
authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global
configuration command. To either disable TACACS+ authentication for logins or to return to the default
value, use the no login authentication {default | list-name} line configuration command.

Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services

AAA authorization limits the services available to a user. When AAA authorization is enabled, the
switch uses information retrieved from the user's profile, which is located either in the local user
database or on the security server, to configure the user's session. The user is granted access to a
requested service only if the information in the user profile allows it.
You can use the aaa authorization global configuration command with the tacacs+ keyword to set
parameters that restrict a user's network access to privileged EXEC mode.
The aaa authorization exec tacacs+ local command sets these authorization parameters:
•
•
Authorization is bypassed for authenticated users who log in through the CLI even if authorization has
Note
been configured.
Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for
privileged EXEC access and network services:
Command
Step 1
configure terminal
Step 2 aaa authorization network tacacs+
Step 3 aaa authorization exec tacacs+
Step 4 end
Step 5
show running-config
Step 6 copy running-config startup-config
To disable authorization, use the no aaa authorization {network | exec} method1 global configuration
command.
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
9-16
Use TACACS+ for privileged EXEC access authorization if authentication was performed by using
TACACS+.
Use the local database if authentication was not performed by using TACACS+.
Purpose
Enter global configuration mode.
Configure the switch for user TACACS+ authorization for all
network-related service requests.
Configure the switch for user TACACS+ authorization to determine if the
user has privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Chapter 9 Configuring Switch-Based Authentication
78-11380-10