Users Guide

● console — Configure authorization for console-entered commands.
● default — Configure authorization for non-console-entered commands and commands entered in
non-console sessions, such as in SSH and VTY.
● local — Use the local username, password, and role entries configured with the username
password role command for command authorization.
● group tacacs+ — Use the TACACS+ servers configured with the tacacs-server host
command for command authorization.
Default Local authorization
Command Mode
● CONFIGURATION
Usage
Information
Re-enter the command to configure additional authorization methods and CLI access. The authorization
methods in the method list execute in the order you configure them. Re-enter the methods to change the
order. The local authorization method remains enabled even if you remove all configured methods in the
list using the no aaa authorization command.
If a console user logs in with TACACS+ authorization, the role you configured for the user on the TACACS
+ server applies. If no role is configured on the security server, user authorization fails.
Example
OS10(config)# aaa authorization commands role sysadmin console group
tacacs+ local
OS10(config)# aaa authorization config-commands role sysadmin default
group tacacs+
OS10(config)# no aaa authorization commands role sysadmin console
Supported
Releases
10.5.1 or later
aaa re-authenticate enable
Requires user re-authentication after a change in the authentication method or server.
Syntax
aaa re-authenticate enable
Parameters None
Default Disabled
Command Mode EXEC
Usage
Information
After you enable user re-authentication and change the authentication method or server, users are logged
out of the switch and prompted to log in again to re-authenticate. User re-authentication is triggered by:
● Adding or removing a RADIUS server as a configured server host with the radius-server host
command.
● Adding or removing an authentication method with the aaa authentication [local |
radius] command.
Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.0E(R3S).
Also supported in SmartFabric mode starting in release 10.5.0.1.
The no version of the command disables user re-authentication.
Example
OS10(config)# aaa re-authenticate enable
Supported
Releases
10.4.0E(R1) or later
Security 1133