Tacacs server configuration problem

[ArsenLiliyev]

Greeting everyone! There is a little problem with configuring tacacs server on ws-2950-24 model switch. The rest switches we have are 2960 series, also 3xxx series and others, more modern versions. We always configured tacacs server this way:

tacacs-server host 10.x.x.x
tacacs-server key 7 xxxxx    (might be summed on one command, depends on switch)

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 0 default group tacacs+ local none
aaa authorization commands 15 default group tacacs+ local none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+

Tacacs begins to work after authorization commands and rest 4 commands you should write after reconnecting to the switch, already by tacacs. In case with 2950, switch takes all commands, but tacacs doesn't work. Does anybody know, may be this switch need to some additional commands or its tacacs configuring different way?

[MHM Cisco World]

Can you more elaborate 

MHM

[ArsenLiliyev]

For example   -   ws-2960 switch, I configure tacacs by writing this commands: 

tacacs-server host 10.x.x.x
tacacs-server key 7 xxxxxx    (might be summed on one command, depends on switch)

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 0 default group tacacs+ local none
aaa authorization commands 15 default group tacacs+ local none

then CLY is throws out, and I reconnect already but tacacs (before I was connected by local username by telnet/ssh)

,and then wrote rest command:

aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+.  

( I just explain how I configure tacacs every time on al swithces)

 In case of 2950 it doesn't work same, and it doesn't work at all. Switch accept all commands, doesn't deny any of them, but tacacs don't work. 

[MHM Cisco World]

Show aaa server <- share this 

MHM

[ArsenLiliyev]

Somewhy I couldn't upload shot to show, then I write it. Switch doesn't recognize this command. There is no command beginning by aaa word. Here: 

QAPI1#show aaa ?
% Unrecognized command
QAPI1#show aaa

QAPI1#show ?
access-lists List access lists
accounting Accounting data for active sessions
aliases Display alias commands
arp ARP table
boot show boot attributes
buffers Buffer pool statistics
cdp CDP information
clock Display the system clock
cluster

[MHM Cisco World]

These commands is not all' 

Let start with auth 

-did you access using local user or user in server ?

-if you use local user what previllige you config for this user 

-if use server what is previllige you set in server

MHM

[ArsenLiliyev]

I just wrote command "username admin privilege 15 secret 5 CryptedPassword "  , that's it. And wrote login local in line vty configuration. Then it is local user and privilege level is 15. I connected to the switch by this login and password via telnet.

[Richard Pidcock]

Have you tried defining you tacacs servers as follows:

aaa group server tacacs+ NAME
 server-private x.x.x.x key *****************
 server-private y.y.y.y key ******************
 ip tacacs source-interface Gix/x
!
aaa authentication login default group NAME local

[ArsenLiliyev]

Doesn't work aslo:

I1(config)#aaa gr
QAPI1(config)#aaa group se
QAPI1(config)#aaa group server ta
QAPI1(config)#aaa group server tacacs+ ABCD
QAPI1(config-sg-tacacs+)#ser
QAPI1(config-sg-tacacs+)#server-p
QAPI1(config-sg-tacacs+)#server-pr
QAPI1(config-sg-tacacs+)#server pr
QAPI1(config-sg-tacacs+)#server ?
Hostname or A.B.C.D IP address of TACACS server
<cr>

QAPI1(config-sg-tacacs+)#server 10.14.14.9 ke
QAPI1(config-sg-tacacs+)#server 10.14.14.9 ?
<cr>

QAPI1(config-sg-tacacs+)#server 10.14.14.9
QAPI1(config-sg-tacacs+)#k
QAPI1(config-sg-tacacs+)#?

Ddoesn't recognize commands

[MHM Cisco World]

You have two user admin in server and admin in local DB' 

You access using admin in server this give you privilege (I dont know what will be) and hence some command is missing' 

Try disconnect server from SW' access again and do show run 

Check login under vty and console and command appear to you.

MHM