Technical data

Security Configuration 7-17
Configuring Authorization
Authorization Examples
The following example uses a TACACS+ server to authorize the use of network services, including
PPP and ARA. If the TACACS+ server is not available or has no information about a user, no
authorization is performed, and the user can use all network services:
2511(config)# aaa authorization network tacacs+ none
The following example permits the user to run the EXEC process if the user is already authenticated.
If the user is not already authenticated, the Cisco IOS software defers to a RADIUS server for
authorization information.
2511(config)# aaa authorization exec if-authenticated radius
The following example configures network authorization. If the TACACS+ server does not respond
or has no information about the username being authorized, the RADIUS server is polled for
authorization information for the user. If the RADIUS server does not respond, the user still can
access all network resources without authorization requirements.
2511(config)# aaa authorization network tacacs+ radius none