Users Guide

Default AAA accounting is disabled.
Command Mode CONFIGURATION
Usage
Information
You can enable the recording of accounting events in both the syslog and on TACACS+ servers.
The no version of the command disables AAA accounting.
Example
OS10(config)# aaa accounting commands all console start-stop logging
group tacacs+
Supported
Releases
10.4.1.0 or later
aaa authentication login
Configures the AAA authentication method for console, SSH, and Telnet logins.
Syntax
aaa authentication login {console | default} {local | group radius | group
tacacs+}
Parameters
● console — Configure authentication methods for console logins.
● default — Configure authentication methods for SSH and Telnet logins.
● local — Use the local username, password, and role entries configured with the username
password role command.
● group radius — Use the RADIUS servers configured with the radius-server host command.
● group tacacs+ — Use the TACACS+ servers configured with the tacacs-server host
command.
Default Local authentication
Command Mode CONFIGURATION
Usage
Information
The no version of this command removes all configured authentication methods and defaults to using
local authentication.
Example
OS10(config)# aaa authentication login default group radius local
OS10(config)# do show running-configuration aaa
aaa authentication login default group radius local
aaa authentication login console local
OS10(config)# no aaa authentication login default
OS10(config)# do show running-configuration aaa
aaa authentication login default local
aaa authentication login console local
Supported
Releases
10.4.1.0 or later
aaa authorization
Enables authorization and configure the authorization methods for CLI access.
Syntax
aaa authorization {commands | config-commands | exec-commands} {role user-
role} {console | default} {[local] [group tacacs+]}
Parameters
● commands — Configure authorization for all CLI commands, including all EXEC and configuration
commands.
● config-commands — Configure authorization only for configuration commands.
● exec-commands — Configure authorization only for EXEC commands.
● role user-role — Configure command authorization for a user role: sysadmin, secadmin,
netadmin, or netoperator.
Security 1345