aaa authorization commands


aaa authorization commands <CONNECTION-TYPE> {local | none}
aaa authorization commands <CONNECTION-TYPE> group <GROUP-LIST>

no aaa authorization commands <CONNECTION-TYPE>


Defines authorization as being basic local RBAC (specified as none), or as full-fledged local RBAC specified as local (the default), or as remote TACACS+ (specified with group <GROUP-LIST>). Each available connection type (channel) can be configured individually. All server groups named in the command, must exist. This command can be issued multiple times, once for each connection type.

The no form of this command unconfigures authorization for the specified connection type, reverting to the default of local.

NOTE: Although only TACACS+ servers are supported for remote authorization, local authorization (basic or full-fledged) can be used with remote RADIUS authentication.

Command context




One of these connection types (channels):

Selects the default connection type for configuration. This configuration applies to all other connection types (console, ssh) that are not explicitly configured with this command. For example, if you do not use aaa authorization commands console... to define the console authorization list, then this default configuration is used for console.

Selects the console connection type for configuration.


Selects the ssh connection type for configuration.

local (the default)

When used alone without group <GROUP-LIST>, selects local authorization which can be used to provide authorization for a purely local setup without any remote AAA servers and also for when RADIUS is used for remote Authentication and Accounting but Authorization is local.

When used after group, provides for fallback (to full-fledged local authorization) when every server in every specified TACACS+ server group cannot be reached.

If any TACACS+ server in the specified groups is reachable, but the command fails to be authorized by that server, the command is rejected and local authorization is never attempted. Local authorization is only attempted if every TACACS+ server cannot be reached.


When used alone without group <GROUP-LIST>, selects basic local RBAC authorization, for use with the built-in user groups (administrators, operators, auditors).

When used after group, provides for fallback (to basic local RBAC authorization) when every server in every specified TACACS+ server group cannot be reached.


With none, for users belonging to user-defined user groups, all commands can be executed regardless of what authorization rules are defined in such groups. For per-command local authorization, use local instead.

group <GROUP-LIST>

Specifies the list of remote AAA server group names. Predefined remote AAA group name tacacs is available. User-defined TACACS+ server group names may also be used. The remote AAA server groups are accessed in the order that the group names are listed in this command. Within each group, the servers are accessed in the order in which the servers were added to the group. Server groups are defined using command aaa server group and servers are added to a server group using command server.

It is recommended to always include either the special name local or none as the last name in the group list. If both local and none are omitted, and no remote AAA server is reachable (or the first reachable server cannot authorize the command), command execution for the current user will not be possible.


Administrators or local user group members with execution rights for this command.


Setting the authorization for default to local:

switch(config)# aaa authorization commands default local

Setting the authorization for the SSH interface to none:

switch(config)# aaa authorization commands ssh none