topic Read-only access to switches in Network Access Control

Read-only access to switches

Vinny — Wed, 13 Mar 2019 00:41:36 GMT

Hi,

I'm trying to figure out what is the best way to limite access to Cisco switch. I'm using AAA and radius for authentication.

My goal is to create a user that will have only "enable" access (all the show commands, etc..). I would like to deny access to "configure terminal" and some other commands like "reload".

What is the best way to do that ? I'm reading about privileges and it doesn't seem to be powerful.

I read a little about Role-based access and views but before starting to configure and test this, I would like to have your hint on this.

Thank you

Read-only access to switches

nspasov — Thu, 14 Mar 2013 04:38:56 GMT

The best way to do this is with a TACACS+ server where you can utilize "command shells" where certain commands are allowed while others not. Radius does not have this functionality and you can only push a "privilege-level" attribute. Thus, if you want to restrict commands then you will have to define those locally on every switch.

Let me know if this makes sense and/or if you have more quesions.

Thank you for rating!

Read-only access to switches

Vinny — Thu, 14 Mar 2013 13:02:33 GMT

You are saying that I can do it locally on switches, what is the best way for that ?

thanks

Read-only access to switches

maldehne — Thu, 14 Mar 2013 13:16:36 GMT

You can do that locally but the best to do is through Tacacs+ command authorization sets.

Check the following links:

http://www.cisco.com/en/US/partner/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

http://www.cisco.com/en/US/partner/products/ps9911/products_configuration_example09186a0080bc8514.shtml

-------------------------------------------------------------------------

Please make sure to rate correct answers

Read-only access to switches

Vinny — Thu, 14 Mar 2013 13:19:54 GMT

I dont' have a tatacs+ server so I need to do it locally.

Thanks

Read-only access to switches

maldehne — Thu, 14 Mar 2013 13:41:01 GMT

you need to change the exec privelege level for the commands based on your need

and then assign the user to the privilege level needed using the command

R(config)#username < username> privilege < 0 -15> password

how to change the priv level of a command

R(config)#privilege exec level <0 15 >

But this is a headache man.

---------------------------------------------------------------------------

Please make sure to rate correct answers