trouble configuring router login w/ACS

[llathrop]

Hi, i am having some trouble configuring my routers to correctly use our ACS server for login, etc.

The goal:
To login through network or console with an approved ACS user name and password, unless the network is down, or the ACS server is unavailable, in which case we would login with a backup local username/password.

The problem is:
I can log in through telnet, using ACS name/pass, but only if the ACS server is available. At the console, i can login, but i am not at the correct access level. If I type en, I am prompted for a password, i can't determine what it would be.

here is the relevant parts of the config:

aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ local if-authenticated
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common
!
!
username netadmin password xxxxx
!
!
tacacs-server host xxx.xxx.xxx.xxx
tacacs-server directed-request
tacacs-server key xxxxxxx

Let me know and I'll provide any other bits of configuration that are needed

I appreciate your help!!

Luke.

 

[jneiberger]

Do you really want to use AAA for your "enable" authentication? The way you have it configured you would have to have your enable password configured in ACS.

 

[llathrop]

Well, we want it so that when you login, you are already at level 15, and don't need to give an enable password. Does that make sense?

That is how it is working now, if you login through telnet. If you login at the console, you are level 1, but can give the enable command, but I can't determine which password to use--is it set somewhere on the acs server?

I also need it to fail back to allow me to logon at the console if the acs server is unavailable.

I appreciate your help!

 

[jneiberger]

As it is right now, you get privilege level 15 if you use Telnet? Can you include the config from your vty lines and console?

 

[llathrop]

sure here you go:

line con 0
line aux 0
line vty 0 4
password 7 xxxxxxx

I have messed around with various things here but none of the things I have tried had any affect so far. I believe I had
"login auth default"
on them all at one point, but it acted just the same.

Thanks!!
Luke

 

[jneiberger]

Try removing the "aaa authentication enable" command and adding "privilege level 15" to your vty and console lines.