Hegedus Gabor <> wrote on Thursday, April 02, 2009 10:37:
> Hi all!
>
> I have a problem:
>
> I want use aaa authentication with radius in c3560, I try to
> authenticate my user to the priv level 15.
> The authentication is succes, but the user is just on the level 1.
>
> radius send back the priv-lvl=15, I can see in the radius debug.
>
> the configurations of the radius and the switch are correct, because
> I have c2960 with the same configuration, and the priv-level 15
> authentication works on it.
>
> here is my config sample:
>
> aaa authentication login method_line group rad_group local
> aaa authorization exec method_line if-authenticated group rad_group
why do you use if-authenticated before radius? if-authenticated method
succeeds if the user is authenticated, so it doesn't even bother
checking radius attributes for authorization information. Please try
aaa authorization exec method_line group rad_group if-authenticated
or
aaa authorization exec method_line group rad_group local
whatever fallback method you want to use..
oli
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
