topic Restrict Single Interface ACS 5.4 in Network Access Control

Restrict Single Interface ACS 5.4

deanlee10 — Mon, 11 Mar 2019 03:38:08 GMT

Hello,

I am running ACS 5.4.0.46.4. I am creating command sets to restrict access for a certain group of users. Is there any way to restrict them from accessing a specific interface (Gi1/1/1 for instance)? I tried putting a "deny interface GigabitEthernet1/1/1" into the command set rules, but I am still able to access that interface?

Restrict Single Interface ACS 5.4

Jatin Katyal — Wed, 10 Jul 2013 12:34:13 GMT

Please post the screen shot of command set that you have created on ACS under policy elements.

From the end network device, get the following o/p

-debug tacacs

-debug aaa authen

-debug aaa author

-show run | in aaa

From ACS 5.4 > monitoring and logging > tacacs authorization > find the user failed attempt > clcik on the magnifying glass in front of it and attach the screen shot of that page.

~BR
Jatin Katyal

**Do rate helpful posts**

Restrict Single Interface ACS 5.4

deanlee10 — Wed, 10 Jul 2013 12:56:04 GMT

Actually I figured it out. I left out the space between the interface type (Gi) and number (1/1/1) in the argument.

Restrict Single Interface ACS 5.4

Jatin Katyal — Wed, 10 Jul 2013 13:01:11 GMT

Alright, that's a good news.

Here is a link to configure command authorization on ACS 5. You may want to bookmark it.

http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc8514.shtml#ade

~BR
Jatin Katyal

**Do rate helpful posts**