John, <div><br></div><div>Thanks you for the reply. The following is configured on my router, can you tell me if anything is incorrect </div><div><br></div><div><pre><font class="Apple-style-span" size="4">aaa group server tacacs+ tacServers
server 10.10.10.10
!
aaa authentication banner ^CCUnauthorized Access Prohibited^C
aaa authentication fail-message ^CCFailed login. Try again.^C
aaa authentication login default group tacServers enable
aaa authorization console
aaa authorization exec default group tacServers if-authenticated
aaa authorization exec console group tacServers if-authenticated
aaa accounting exec default start-stop group tacServers
aaa accounting commands 1 default start-stop group tacServers
aaa accounting commands 2 default start-stop group tacServers
aaa accounting commands 5 default start-stop group tacServers
aaa accounting commands 15 default start-stop group tacServers</font></pre><br><div class="gmail_quote">On Thu, Aug 18, 2011 at 3:09 PM, john heasley <span dir="ltr"><<a href="mailto:heas@shrubbery.net">heas@shrubbery.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Thu, Aug 18, 2011 at 12:22:42PM -0400, Mike Keselman:<br>
<div class="im">> Hi,<br>
><br>
> I am running tacacs+ version tacacs+-F4.0.4.19-1 in my envelopment. I am<br>
> having issues configuring Cisco commands with in the daemon. Currently my<br>
> cisco gear has privilege 5 permission configured for a subset of commands. I<br>
> have to move those commands to a central place as opposed to having them on<br>
> each device. Any help would be appreciated.<br>
><br>
> Sample of what is configured is below<br>
><br>
><br>
> group = test {<br>
> # description: test group<br>
> default service = deny<br>
> service = exec {<br>
> priv-lvl = 5<br>
> }<br>
> }<br>
><br>
> user = tactest {<br>
> login = cleartext tac<br>
><br>
> member = test<br>
><br>
> cmd = configure { permit terminal }<br>
> cmd = show {<br>
> permit .* }<br>
> }<br>
<br>
</div>i dont know if those commands will work with level 5.<br>
<br>
but suspect your problem is the authorization configuration on the router.<br>
<br>
eg:<br>
# group = RO {<br>
# service = exec {<br>
# priv-lvl=15<br>
# }<br>
# cmd = show {<br>
# permit run<br>
# permit version<br>
# permit install<br>
# permit env<br>
# permit gsr<br>
# permit boot<br>
# permit bootvar<br>
# permit flash<br>
# permit controllers<br>
# permit controllers<br>
# permit diagbus<br>
# permit diag<br>
# permit c7200<br>
# deny .*<br>
# }<br>
# cmd = write {<br>
# permit term<br>
# deny .*<br>
# }<br>
# cmd = dir {<br>
# permit /all<br>
# deny .*<br>
# }<br>
# }<br>
<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>
<p><b><span>Mike Keselman</span></b></p><p><b><span></span></b>M5 Networks, Inc.</p>
<p><span><span>Phone: (646)747-1632</span></span></p>
<p><span></span><a href="http://www.m5net.com/" target="_blank"><span><span>www.m5net.com</span></span><span></span></a><span></span><span style="font-size:10pt"></span></p>
<br>
</div>