Hello-<div><br></div><div>I just inherited a handful of crusty Cisco Catalyst 4006 switches running CatOS, and I need to integrate them into my support tools. Part of this requirement is automatically enabling users upon login, as we do not like the enable being known by humans except in the event of maintenance or emergencies (or maintenance emergencies!), so we use privilege escalation on the server-side to do this.</div>
<div><br></div><div>I have managed authentication for many thousands of device of various vendors, shapes, and sizes over the years, but this is the first time I've ever wrangled with CatOS and also the first time I've ever had a problem making auto-enable work with little trouble. </div>
<div><br></div><div><div>What I have in the server config is this:</div><div><br></div><div>## Production Engineers</div><div>## priv-lvl = 15</div><div>group = engineers {</div><div> default service = permit</div>
<div> service = exec {</div><div> priv-lvl = 15</div><div> }</div><div>}</div></div><div><br></div><div>So what we normally see with Cisco devices is something like this:</div><div><br></div><div>
...</div><div><div>User Access Verification</div><div><br></div><div>Username: jathan</div><div>Password: ********</div><div><br></div><div>cisco-router#<br></div><div>...</div><div><br></div><div>So far I have been unable to get this Catalyst switch to automatically enable me. In perusing the Cisco support forums it seems to be fully supported, but of course all of the "help" there-in refers to Cisco's ACS, and so really isn't too helpful.</div>
<div><br></div><div>Here is what is configured on the switch (non-tacacs stuff ommitted):</div><div><br></div><div><div>#tacacs+</div><div>set tacacs server 1.2.3.4 primary</div><div>set tacacs server 2.4.6.8</div><div>set tacacs attempts 3</div>
<div>set tacacs directedrequest disable</div><div>set tacacs key abc123</div><div>set tacacs timeout 5</div><div><br></div><div><div>#authentication</div><div>set authentication login tacacs enable console primary</div><div>
set authentication login tacacs enable telnet primary</div><div>set authentication enable tacacs disable console </div><div>set authentication enable tacacs disable telnet </div><div>set authentication enable local enable console </div>
<div>set authentication enable local enable telnet </div><div><br></div><div><div><div>#accounting</div><div>set accounting exec enable start-stop tacacs+</div><div>set accounting connect enable start-stop tacacs+</div><div>
set accounting system enable start-stop tacacs+</div><div>set accounting commands enable all start-stop tacacs+</div><div>set accounting suppress null-username disable</div><div><br></div><div><div>#authorization</div><div>
set authorization exec enable tacacs+ none console</div><div>set authorization exec enable tacacs+ none telnet</div><div>set authorization enable disable console</div><div>set authorization enable disable telnet</div><div>
set authorization commands disable console</div><div>set authorization commands disable telnet</div></div></div></div></div></div><div><br></div><div>I am curious if anyone else has conquered this challenge and what combination of device commands and tac_plus configuration tweaks are necessary to make it work.</div>
<div><br></div><div>Thanks in advance for any help on this matter!</div><div><br></div>-- <br>Jathan.<br>-<br>
</div>