In which configuration mode is aaa authorization exec default group tacacs+ local used?

The aaa authorization exec default group tacacs+ local command is entered in Global Config mode on Cisco IOS devices.

AAAGlobal Config

aaa authorization exec default group tacacs+ local

Configures AAA authorization for EXEC sessions, using TACACS+ as the primary method and local authentication as fallback, to control user access to the CLI after authentication.

Definition: aaa authorization exec default group tacacs+ local is a Cisco IOS global config command. Configures AAA authorization for EXEC sessions, using TACACS+ as the primary method and local authentication as fallback, to control user access to the CLI after authentication.

Overview

The `aaa authorization exec default group tacacs+ local` command is a critical component of Cisco's Authentication, Authorization, and Accounting (AAA) framework, specifically targeting authorization for EXEC sessions. EXEC authorization determines what level of access a user has to the CLI after they have been authenticated. This command instructs the router or switch to first attempt authorization via a TACACS+ server (group tacacs+), and if that server is unreachable or does not respond, fall back to the local database on the device.

This ensures that even if the central TACACS+ server fails, users can still be authorized based on locally defined privilege levels or user accounts. The command is typically used in enterprise environments where centralized control over user permissions is required, but network resilience is also a priority. Without EXEC authorization, any authenticated user would gain full access to the CLI, which could be a security risk.

By contrast, using only local authorization would require manual configuration on every device, which is not scalable. The command fits into a broader AAA workflow: first, authentication verifies the user's identity (e.g., via TACACS+ or local); then, authorization determines what commands or access levels the user is permitted; finally, accounting logs the user's activities. In practice, this command is often paired with `aaa authentication login default group tacacs+ local` and `aaa accounting exec default start-stop group tacacs+`.

Important IOS behaviors: the command is applied globally, and the order of methods in the list matters—the first method listed is tried first. If the TACACS+ server returns a deny, the user is denied immediately without falling back to local. If the server is unreachable (timeout), the fallback to local occurs.

The command does not affect the running config until it is entered, and it requires the `aaa new-model` command to be enabled first. Privilege level requirements: entering this command requires global configuration mode (privilege level 15). Buffered output is not directly affected, but the command influences the behavior of subsequent EXEC sessions.

Understanding this command is essential for CCNA and CCNP candidates as it appears in exam topics related to device access control and security.

Syntax·Global Config

aaa authorization exec default group tacacs+ local

When to Use This Command

Centralized control of user CLI access in a multi-site enterprise network using TACACS+ servers
Providing fallback to local user accounts when TACACS+ servers are unreachable during WAN outages
Enforcing different privilege levels for different user groups via TACACS+ authorization
Integrating with existing TACACS+ infrastructure for consistent access control across all network devices

Parameters

Parameter	Syntax	Required	Description
exec	exec	Required	Specifies that authorization is for EXEC sessions (user CLI access after login). This parameter is fixed and must be included exactly as shown.
default	default	Required	Indicates that this authorization method list is the default for all EXEC sessions. If not specified, a named list would be used instead.
group tacacs+	group tacacs+	Required	Specifies TACACS+ as the primary authorization method. The 'group' keyword indicates that the TACACS+ server group (defined globally) will be used. If no servers are configured, authorization will fail.
local	local	Required	Specifies the local user database as the fallback method. If TACACS+ is unreachable, the device will check its local user accounts for authorization. This method is case-sensitive and must be spelled exactly as 'local'.

Command Examples

Basic AAA Authorization for EXEC with TACACS+ and Local Fallback

aaa authorization exec default group tacacs+ local

Router(config)# aaa authorization exec default group tacacs+ local
Router(config)# end
Router# show running-config | include aaa authorization exec
aaa authorization exec default group tacacs+ local

The command enables EXEC authorization using the default method list. The 'group tacacs+' specifies TACACS+ as the primary server group, and 'local' provides fallback to local database. The output confirms the configuration is applied.

Verifying AAA Authorization Configuration

show aaa method-list authorization exec

Method List Name: default
  Type: Authorization
  Group: tacacs+
  Local: Yes

This output shows the method list details. 'Method List Name' is 'default', 'Type' is Authorization, 'Group' lists the server group (tacacs+), and 'Local: Yes' indicates local fallback is configured.

Understanding the Output

The command itself does not produce output; it configures the device. To verify, use 'show running-config | include aaa authorization exec' to see the line. The output shows the exact command as configured.

In a real network, you would also check TACACS+ server reachability with 'test aaa group tacacs+ username password' and monitor debug output with 'debug aaa authorization' to see authorization decisions. Good values show 'PASS' for authorization, while failures indicate misconfiguration or server issues.

Configuration Scenarios

Configure AAA EXEC Authorization with TACACS+ and Local Fallback on a Branch Router

A branch office router needs to control CLI access for administrators. The central TACACS+ server is located at HQ, but the WAN link may be unreliable. Local fallback ensures that administrators can still access the router if the TACACS+ server is unreachable.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2 (R2 is HQ router with TACACS+ server 10.0.12.2)

Steps

1.Step 1: Enable AAA new-model: Router(config)# aaa new-model
2.Step 2: Configure TACACS+ server: Router(config)# tacacs-server host 10.0.12.2 key SecretKey123
3.Step 3: Create a default authentication method list: Router(config)# aaa authentication login default group tacacs+ local
4.Step 4: Create the default EXEC authorization method list: Router(config)# aaa authorization exec default group tacacs+ local
5.Step 5: Optionally enable accounting: Router(config)# aaa accounting exec default start-stop group tacacs+
6.Step 6: Verify configuration: Router# show running-config | section aaa

Configuration

!
aaa new-model
!
tacacs-server host 10.0.12.2 key SecretKey123
!
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
!

Verify: Router# show aaa sessions or Router# test aaa authorization exec username admin privilege 15 password cisco. Expected: If TACACS+ is reachable, authorization is granted by the server. If not, local user 'admin' with privilege 15 is used.

Watch out: If the TACACS+ server is reachable but returns a deny (e.g., user not authorized for EXEC), the fallback to local does NOT occur. The user is denied access immediately.

Configure Named EXEC Authorization List for Different User Groups

A large enterprise requires different authorization policies for network engineers (full access) and helpdesk staff (limited access). A named authorization list allows different methods per group, while the default list remains for others.

Topology

Core switch SW1 (Vlan 1: 192.168.1.1/24) connected to TACACS+ server at 192.168.1.100

Steps

1.Step 1: Enable AAA: SW1(config)# aaa new-model
2.Step 2: Configure TACACS+ server: SW1(config)# tacacs-server host 192.168.1.100 key T@cacsKey
3.Step 3: Create a named authentication list for engineers: SW1(config)# aaa authentication login ENGINEER_LIST group tacacs+ local
4.Step 4: Create a named authorization list for engineers: SW1(config)# aaa authorization exec ENGINEER_AUTH group tacacs+ local
5.Step 5: Apply the authentication list to VTY lines: SW1(config)# line vty 0 4, SW1(config-line)# login authentication ENGINEER_LIST
6.Step 6: Apply the authorization list to VTY lines: SW1(config-line)# authorization exec ENGINEER_AUTH
7.Step 7: For helpdesk, create a separate list with local only: SW1(config)# aaa authorization exec HELPDESK_AUTH local
8.Step 8: Apply to appropriate lines or use default for others.

Configuration

!
aaa new-model
tacacs-server host 192.168.1.100 key T@cacsKey
!
aaa authentication login ENGINEER_LIST group tacacs+ local
aaa authorization exec ENGINEER_AUTH group tacacs+ local
aaa authorization exec HELPDESK_AUTH local
!
line vty 0 4
 login authentication ENGINEER_LIST
 authorization exec ENGINEER_AUTH
!

Verify: SW1# show line vty 0 4 | include authorization. Expected: 'Authorization: ENGINEER_AUTH'. Also test by SSHing with a user that is in TACACS+ and local.

Watch out: If a named authorization list is applied to a line, the default list is not used. Ensure that the named list includes all necessary methods, otherwise users may be denied if the primary method fails.

Troubleshooting with This Command

When troubleshooting EXEC authorization issues, the first step is to verify that AAA is enabled globally with `show running-config | include aaa new-model`. If not, the command will not take effect. Next, check the TACACS+ server configuration: `show tacacs` displays the server IP, port, and key status.

A common problem is a mismatched key between the device and the TACACS+ server, which causes authentication and authorization failures. Use `debug tacacs` to see detailed TACACS+ packets; look for 'Authorisation request' and 'Authorisation response' messages. If the TACACS+ server is unreachable, the device will fall back to local authorization only if the 'local' method is included in the list.

Verify the fallback behavior by disconnecting the TACACS+ server or using an incorrect key. The `show aaa sessions` command displays active AAA sessions and their authorization status. For local authorization, ensure that local users have the correct privilege level: `username admin privilege 15 secret cisco`.

If a user is denied, check the `show logging` for AAA error messages like 'AAA: authorization failed'. Another useful command is `test aaa authorization exec username <user> privilege <level> password <pass>` which simulates an authorization request. Healthy output shows 'Authorization succeeded' with the privilege level.

Problem indicators include 'Authorization denied' or 'Server not reachable'. Also, verify that the VTY lines have the correct authorization applied: `show line vty 0 4 | include authorization`. If the line uses a named list, ensure that list exists and is correctly configured.

Correlate with `debug aaa authorization` to see the exact method list being used and the result. A step-by-step diagnostic flow: 1) Confirm AAA is on. 2) Check TACACS+ reachability (ping, show tacacs). 3) Verify method list order. 4) Test with a known good user. 5) Check logs and debugs. 6) If fallback fails, ensure local user exists and has privilege level. 7) If using named lists, verify line configuration.

CCNA Exam Tips

CCNA exam may ask which command enables EXEC authorization with TACACS+ and local fallback; remember the exact syntax 'aaa authorization exec default group tacacs+ local'.

Understand that 'default' applies to all lines unless overridden; exam might test overriding with named lists.

Know that 'group tacacs+' refers to a server group defined under 'tacacs server' commands; exam may test the difference between 'group' and 'single-connection'.

Be aware that 'local' fallback is used only if TACACS+ servers are unreachable, not if they reject authorization.

Common Mistakes

Forgetting to configure TACACS+ server definitions and keys before using 'group tacacs+', causing authorization failures.

Using 'aaa authorization exec default local' without TACACS+, which bypasses centralized control.

Misordering methods: placing 'local' before 'group tacacs+' causes local to be tried first, defeating the purpose of centralized authorization.

aaa authorization exec default group tacacs+ local vs aaa new-model

Both commands are essential for configuring AAA EXEC authorization, but they operate at different levels. `aaa new-model` globally enables AAA services on the device, while `aaa authorization exec default group tacacs+ local` defines the specific authorization method for EXEC sessions. Confusion arises because both are required for the authorization to function, but they serve distinct roles.

Aspect	aaa authorization exec default group tacacs+ local	aaa new-model
Scope	Global configuration defining a method list for EXEC authorization	Global configuration enabling AAA framework across all services
Function	Specifies authorization method (TACACS+ first, local fallback) for CLI access	Turns on AAA processing; required before any AAA commands
Dependencies	Requires `aaa new-model` to be configured first	Must be entered before other AAA commands, but has no dependencies itself
Persistence	Saved in running-config and startup-config as part of AAA configuration	Saved as a single command; removal disables all AAA
Typical Use	Used when you want to control user-level access after authentication with TACACS+	Used at the start of any AAA deployment

Use aaa authorization exec default group tacacs+ local when you need to enforce TACACS+-based authorization for CLI access, with local database as backup.

Use aaa new-model when you want to enable AAA security services on the device as a prerequisite for all AAA commands.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical to classic IOS. However, the TACACS+ server configuration may use the newer `tacacs server` command under a server template: `tacacs server TACACS1` then `address ipv4 10.0.12.2` and `key SecretKey123`. The `aaa authorization exec default group tacacs+ local` command remains the same.

In NX-OS (e.g., Nexus switches), the equivalent command is `aaa authorization exec default group tacacs+ local` but note that NX-OS uses `feature tacacs+` to enable TACACS+ and the server configuration is under `tacacs-server host <ip> key <key>`. Also, NX-OS requires `aaa authentication login default group tacacs+ local` before authorization works. For ASA firewalls, EXEC authorization is not directly applicable; instead, command authorization is handled via `aaa authorization command` with TACACS+.

In IOS-XR, the command is different: `aaa authorization exec default group tacacs+ local` is not supported; IOS-XR uses a different AAA model with task groups and user groups. The command exists in IOS 12.x, 15.x, and 16.x with the same syntax, but in 12.x, the `tacacs-server host` command is used, while in 15.x and later, both old and new styles are supported. There are no significant output differences between versions for this command.

Related Commands

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions