White Papers

Undo a configuration with the no aaa authorization commands {level | role role-
name}{name | default} {local | tacacs+ | none} command.
Parameters
commands level Enter the keyword commands then the command privilege level for command level
authorization.
role role-name Enter the keyword role then the role name. role method is supported only on
Full-Switch mode.
name Define a name for the list of authorization methods.
default Define the default list of authorization methods.
local Use the authorization parameters on the system to perform authorization.
tacacs+ Use the TACACS+ protocol to perform authorization.
none Enter the keyword none to apply no authorization.
Defaults none
Command Modes CONFIGURATION
Supported Modes All Modes.
Command
History
Version Description
9.9(0.0) Introduced on the FN IOM.
9.5(0.0) Introduced the support for roles on the MXL 10/40GbE Switch .
8.3.16.1 Introduced on the MXL 10/40GbE Switch IO Module.
aaa authorization role-only
Configure authentication to use the user’s role only when determining if access to commands is permitted.
Syntax
aaa authorization role-only
To return to the default setting, use the no aaa authentication role-only command.
Parameters
name Enter a text string for the name of the user up to 63 characters. It cannot be one
of the system defined roles (sysadmin, secadmin, netadmin, netoperator).
inherit existing-
role-name
Enter the inherit keyword then specify the system defined role to inherit
permissions from (sysadmin, secadmin, netadmin, netoperator).
Defaults none
Command Modes CONFIGURATION
Supported Modes Full–Switch
Command
History
Version Description
9.9(0.0) Introduced on the FN IOM.
9.7(0.0) Introduced on the S6000-ON.
9.5(0.0) Introduced on the Z9000, S6000, S4820T, S4810, and MXL.
Usage
Information
By default, access to commands are determined by the user’s role (if defined) or by the user’s privilege
level. If the aaa authorization role-only command is enabled, then only the user’s role is used.
Before you enable role-based only AAA authorization:
1. Locally define a system administrator user role.This will give you access to login with full permissions
even if network connectivity to remote authentication servers is not available.
Security 1015