5-19
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter5 Administrating the Access Point
Controlling Access Point Access with TACACS+
To disable AAA, use the no aaa new-model global configuration command. To disable AAA
authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global
configuration command. To either disable TACACS+ authentication for logins or to return to the default
value, use the no login authentication {default | list-name} line configuration command.
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services
AAA authorization limits the services available to a user. When AAA authorization is enabled, the
wireless device uses information retrieved from the user profile, which is located either in the local user
database or on the security server, to configure the user session. The user is granted access to a requested
service only if the information in the user profile allows it.
You can use the aaa authorization global configuration command with the tacacs+ keyword to set
parameters that restrict a user network access to privileged EXEC mode.
The aaa authorization exec group tacacs+ local command sets these authorization parameters:
•Use TACACS+ for privileged EXEC access authorization if authentication was performed by using
TACAC S+.
•Use the local database if authentication was not performed by using TACACS+.
Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has
been configured.
Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for
privileged EXEC access and network services:
To disable authorization, use the no aaa authorization {network | exec} method1 global configuration
command.
Displaying the TACACS+ Configuration
To display TACACS+ server statistics, use the show tacacs privileged EXEC command.
Command Purpose
Step1 configure terminal Enter global configuration mode.
Step2 aaa authorization network group
tacacs+
Configure the wireless device for user TACACS+ authorization for all
network-related service requests.
Step3 aaa authorization exec group tacacs+ Configure the wireless device for user TACACS+ authorization to
determine if the user has privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
Step4 end Return to privileged EXEC mode.
Step5 show running-config Verify your entries.
Step6 copy running-config startup-config (Optional) Save your entries in the configuration file.