Cisco Catalyst 4500 series Administration Manual page 155

Chapter 3 Configuring the Switch for the First Time
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services
AAA authorization limits the services available to a user. When AAA authorization is enabled, the
switch uses information retrieved from the user's profile, which is located either in the local user
database or on the security server, to configure the user's session. The user is granted access to a
requested service only if the information in the user profile allows it.
To set parameters that restrict a user's network access to privileged EXEC mode, use the aaa
authorization global configuration command with the tacacs+ keyword.
The aaa authorization exec tacacs+ local command sets these authorization parameters:
•
•
Authorization is bypassed for authenticated users who log in through the CLI even if authorization has
Note
been configured.
To specify TACACS+ authorization for privileged EXEC access and network services, perform this task,
beginning in privileged EXEC mode:
Command
Step 1
configure terminal
Step 2
aaa authorization network tacacs+
Step 3
aaa authorization exec tacacs+
Step 4
end
Step 5
show running-config
Step 6
copy running-config startup-config
To disable authorization, use the no aaa authorization {network | exec} method1 global configuration
command.
Starting TACACS+ Accounting
The AAA accounting feature tracks the services that users are accessing and the amount of network
resources that they are consuming. When AAA accounting is enabled, the switch reports user activity to
the TACACS+ security server in the form of accounting records. Each accounting record contains
accounting attribute-value (AV) pairs and is stored on the security server. This data can then be analyzed
for network management, client billing, or auditing.
OL-30933-01
Use TACACS+ for privileged EXEC access authorization if authentication was performed by using
TACACS+.
Use the local database if authentication was not performed by using TACACS+.
Purpose
Enters global configuration mode.
Configures the switch for user TACACS+ authorization for all
network-related service requests.
Configures the switch for user TACACS+ authorization if the user has
privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
Returns to privileged EXEC mode.
Verifies your entries.
(Optional) Saves your entries in the configuration file.
Controlling Access to Privileged EXEC Commands
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
3-21