# Ansible with Cisco IOS and two steps authentication (Tacacs)

**URL:** <https://forum.ansible.com/t/ansible-with-cisco-ios-and-two-steps-authentication-tacacs/20804>\
**Category:** Ansible Project\
**Created:** [March 8, 2016, 3:30pm UTC](https://forum.ansible.com/t/ansible-with-cisco-ios-and-two-steps-authentication-tacacs/20804 "2016-03-08T15:30:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Uni1](https://avatars.discourse-cdn.com/v4/letter/u/aca169/32.png) [@Uni1](https://forum.ansible.com/u/Uni1)\
**Post date:** [March 8, 2016, 3:30pm UTC](https://forum.ansible.com/t/ansible-with-cisco-ios-and-two-steps-authentication-tacacs/20804/1 "2016-03-08T15:30:13Z")

</div>

Hi guys

I am totally new to Ansible. Could anyone of you please point me to an example on how to use Ansible with two steps authentication? Our network devices access in controlled by Tacas+ and we have to authenticate to get access and then use “enable x” to get to the access level that we need. This command also requires authentication How is this handled in Ansible?

---

<div class="post-metadata">

**Author:** ![psprygada](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@psprygada](https://forum.ansible.com/u/psprygada)\
**Post date:** [March 9, 2016, 12:32am UTC](https://forum.ansible.com/t/ansible-with-cisco-ios-and-two-steps-authentication-tacacs/20804/2 "2016-03-09T00:32:20Z")

</div>

You can use the following arguments to any of the IOS modules:

authorize: yes  
auth\_pass: \<your enable password.

---

<div class="post-metadata">

**Author:** ![Uni1](https://avatars.discourse-cdn.com/v4/letter/u/aca169/32.png) [@Uni1](https://forum.ansible.com/u/Uni1)\
**Post date:** [March 9, 2016, 10:46am UTC](https://forum.ansible.com/t/ansible-with-cisco-ios-and-two-steps-authentication-tacacs/20804/3 "2016-03-09T10:46:01Z")

</div>

Would that work when I send “enable 7” instead of “enable” ?  
How do I make Ansible use “enable 7” for authoirzation?

---

<div class="post-metadata">

**Author:** ![Christer\_Hemgren](https://avatars.discourse-cdn.com/v4/letter/c/97f17d/32.png) [@Christer\_Hemgren](https://forum.ansible.com/u/Christer_Hemgren)\
**Post date:** [January 5, 2017, 7:39pm UTC](https://forum.ansible.com/t/ansible-with-cisco-ios-and-two-steps-authentication-tacacs/20804/4 "2017-01-05T19:39:55Z")

</div>

Hi Uni

You can use your tacacs to not need “enable 7” as I do not think the module support it.

Meaning when user x enter only standard enable and authorize by tacacs return enable privilage level 7.  
See [http://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13860-PRIV.html](http://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13860-PRIV.html)

Christer