User Guide for Cisco Secure Access Control Server - Stewing Home

Advanced User Authentication Settings
6-22
User Guide for Cisco Secure Access Control Server 4.2
Chapter 6 User Management
Tip If the Advanced TACACS+ Settings (User) table does not appear, choose Interface Configuration >
TACACS+ (Cisco IOS). Then, choose Advanced TACACS+ Features.
This section contains:
Setting Enable Privilege Options for a User, page 6-22
Setting TACACS+ Enable Password Options for a User, page 6-23
Setting TACACS+ Outbound Password for a User, page 6-24
Setting Enable Privilege Options for a User
You use a TACACS+ Enable Control with Exec session to control administrator access. Typically, you
use it for router-management control. Select and specify the user privilege level:
Use Group Level Setting—Sets the privileges for this user identical to the privileges configured at
the group level.
No Enable Privilege—Disallows enable privileges for this user.
Note No Enable Privilege is the default setting.
Max Privilege for any AAA Client—You can select from a list the maximum privilege level that
will apply to this user on any AAA client on which this user is authorized.
Define Max Privilege on a per-Network Device Group Basis—You can associate maximum
privilege levels for this user in one or more NDGs.
Note For information about privilege levels, refer to your AAA client documentation.
Tip You must configure NDGs from within Interface Configuration before you can assign user privilege
levels to them.
To select and specify the privilege level for a user:
Step 1 Perform Step 1 through Step 3 of Adding a Basic User Account, page 6-3.
The User Setup Edit page opens. The username that you add or edit appears at the top of the page.
Step 2 Under TACACS+ Enable Control in the Advanced TACACS+ Settings table, select one of the four
privilege options:
Use Group Level Setting
No Enable Privilege
Note No Enable Privilege is the default setting; when setting up an new user account, this
privilege should already be selected.
Max Privilege for Any Access Server
OL-14386-02