Users Guide

Default Local authorization
Command Mode
● CONFIGURATION
Usage
Information
Re-enter the command to configure additional authorization methods and CLI access. The authorization
methods in the method list execute in the order you configure them. Re-enter the methods to change the
order. The local authorization method remains enabled even if you remove all configured methods in the
list using the no aaa authorization command.
If a console user logs in with TACACS+ authorization, the role you configured for the user on the
TACACS+ server applies. If no role is configured on the security server, user authorization fails.
Example
OS10(config)# aaa authorization commands role sysadmin console group
tacacs+ local
OS10(config)# aaa authorization config-commands role sysadmin default
group tacacs+
OS10(config)# no aaa authorization commands role sysadmin console
Supported
Releases
10.5.1 or later
aaa re-authenticate enable
Requires user re-authentication after a change in the authentication method or server.
Syntax
aaa re-authenticate enable
Parameters None
Default Disabled
Command Mode EXEC
Usage
Information
After you enable user re-authentication and change the authentication method or server, users are logged
out of the switch and prompted to log in again to re-authenticate. User re-authentication is triggered by:
● Adding or removing a RADIUS server as a configured server host with the radius-server host
command.
● Adding or removing an authentication method with the aaa authentication [local |
radius] command.
Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.0E(R3S).
Also supported in SmartFabric mode starting in release 10.5.0.1.
The no version of the command disables user re-authentication.
Example
OS10(config)# aaa re-authenticate enable
Supported
Releases
10.4.0E(R1) or later
tacacs-server host
Configures a TACACS+ server and the key used to authenticate the switch on the server.
Syntax
tacacs-server host {hostname | ip-address} key {0 authentication-key | 9
authentication-key | authentication-key} [auth-port port-number]
Parameters
● hostname — Enter the host name of the TACACS+ server.
● ip-address — Enter the IPv4 (A.B.C.D) or IPv6 (x:x:x:x::x) address of the TACACS+ server.
● key 0 authentication-key — Enter an authentication key in plain text. A maximum of 42
characters.
Security 1325