On Thu, 2013-02-07 at 23:51 -0500, Norman Zhang wrote:
Hi,
Using freeradius2-2.1.12. I need to setup read-write access for both Cisco NX-OS and IOS devices. I did the following,
DEFAULT Group == operator-rw, Auth-Type = System Service-Type = NAS-Prompt-User, cisco-avpair := "shell:roles*\"network-admin vdc-admin priv-lvl=15\""
I can log into both NX-OS and IOS devices; however, IOS devices only permits exec mode not the privileged exec (enable) mode. Not sure if I'm doing something wrong on the syntax. Can someone give me few pointers?
I guess you should not concatenate the IOS and NX-OS attributes to a single combined attribute. Also, "priv-lvl=15" should be "shell:priv-lvl=15" I believe. This should work: DEFAULT Group == operator-rw, Auth-Type = System Cisco-AVPair+="shell:roles=network-admin vdc-admin", Cisco-AVPair+="shell:priv-lvl=15", Service-Type = NAS-Prompt-User -Øystein