topic Configuring ACS 5.x for Restricted Dev Admin Command Set in Network Access Control

Configuring ACS 5.x for Restricted Dev Admin Command Set

Mike Masalla — Mon, 11 Mar 2019 03:22:00 GMT

Hi every one there,

I am not new to ACS business, but this is the first time I am about to configure ACS 5.3 to authorize user group from doing some commands in the "configure mode" while permitting them some other commands. As example, I want to deny them from doing "reload" but give them access to configure "time-range", what happen is, they are denied access to "reload" on the exec mode, but once they went into "configure" mode, they would be able to "do reload"

I mean to say, is it possible to manage the subsequent commands to "configure terminal" ?

Thanks

Configuring ACS 5.x for Restricted Dev Admin Command Set

Jagdeep Gambhir — Fri, 26 Apr 2013 21:37:12 GMT

Mike,

If this is IOS then make sure we have this command added,

aaa authorization config-command

This will authorize all commands executed in config t mode.

Regards,

~JG

Do rate helpful posts

Configuring ACS 5.x for Restricted Dev Admin Command Set

Amjad Abdullah — Sat, 27 Apr 2013 05:10:41 GMT

Mike,

Like Jagdeep replied above, if you use that command on the IOS device (switch or router) then once you are on privileged mode you'll have all commands permitted.

You have to configure the ACS however to restrict access to the reload command for users in the enable mode.

This example will help you if you don't have an idea about the configuration already:

http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc8514.shtml

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

Configuring ACS 5.x for Restricted Dev Admin Command Set

Mike Masalla — Sat, 27 Apr 2013 10:39:27 GMT

Thanks Jagdeep, yes I am applying the commands to an IOS device. I have added your magic aaa authorization config-command to IOS device aaa policy and tested it, looks great. Thank you very much.

Re: Configuring ACS 5.x for Restricted Dev Admin Command Set

Vinay Sharma — Fri, 03 May 2013 10:17:24 GMT

Thanks for this info 🙂 5+