у меня так работает
aaa authentication login default group %groupname%
aaa authentication login console local
aaa authorization config-commands default group %groupname% local
aaa authorization commands default group %groupname% local
aaa accounting default group %groupname%
no aaa user default-role