topic ACS configuration for Authorization in Network Access Control

ACS configuration for Authorization

patrick.girigorie — Mon, 11 Mar 2019 04:02:59 GMT

Hi,

I'm checking if some can help me out with a specific configuration.

We are deploying the Cisco ACS in our network and have configured for the Authorization AAA to our AD.

Now what we want to do is to give the technician normal access for monitoring an troubleshooting which is only certain commands show* and allow them to use the enabled password to gain access to the conf t and other commands.

We have trying to give them:

Shell profiles Default Privilege: Static 10;

Maximum Privilege: Static 10;

Command Sets:

Permit Show *

Deny Conf*

Deny Wr*

Deny Rel*

While do this if gives the message correctly when using conf t and give a message "Command Authorazation failed, but when typing enable not is happening.

What should be done to correctly configure this.

Patrick

ACS configuration for Authorization

Jatin Katyal — Wed, 30 Oct 2013 16:48:00 GMT

Did you find this document in your research? If no then you may want to take a look at it.

http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc8514.shtml

Also, please set the maximum privilege to 15 before you test command authorization.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS configuration for Authorization

patrick.girigorie — Wed, 30 Oct 2013 18:21:07 GMT

Hi Jatin,

Thanks for the reply, Yes i have tried this but the problem that I want the limited access engineer to make use of the enable password for the to gain access to the conf t.

So same user who normally has limited access will change his priv level by using the enable password (or something else) for them to gain the total access for configuration of the equipement.

Thanks,

Patrick

ACS configuration for Authorization

Jatin Katyal — Thu, 31 Oct 2013 12:37:40 GMT

Could you please share the output of "show run | in aaa" in your next reply.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS configuration for Authorization

patrick.girigorie — Thu, 31 Oct 2013 14:04:47 GMT

Hi Jatin,

Yes of course:

See below.

aaa authentication login default group tacacs+

aaa authentication enable default group tacacs+ enable

aaa authorization config-commands

aaa authorization exec default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local aaa authentication login default group tacacs+

Thanks,

Patrick

ACS configuration for Authorization

Jatin Katyal — Thu, 31 Oct 2013 15:29:43 GMT

I would also suggest you to have complete configuration for command authorization so add these two commands as well.

aaa authorization commands 0 default group tacacs+ local

aaa authorization commands 1 default group tacacs+ local

In order to present enable password mode to your technician (read-pnly users) you have to configure ACS like this.

let me know how it goes.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS configuration for Authorization

patrick.girigorie — Thu, 31 Oct 2013 19:03:54 GMT

Jatin,

Ok almost there it is working but I cannot get the show run to work when in view-only and additionally the configured enable password on the router is not working anymore.

Can you help with this?

Patrick

ACS configuration for Authorization

Jatin Katyal — Thu, 31 Oct 2013 21:18:06 GMT

so you're saying when you execute "show run", it says command authorization failed. If yes then I would be interested to see the syntax that you've defined on ACS under command sets. Also why enable authentication is not going to local database i.e router because in your configuration, you've defined that it should go and check enable password tacacs server first however if it doesn't work check locally defined enable password. Since your tacacs server is up and running, we have to use enable password from tacacs.

Here is what you have.

aaa authentication enable default group tacacs+ enable

~BR
Jatin Katyal

**Do rate helpful posts**

ACS configuration for Authorization

patrick.girigorie — Thu, 31 Oct 2013 22:49:31 GMT

Jatin,

Hope it's clear the image.

Just changed the enable to local only.

Patrick

ACS configuration for Authorization

blenka — Fri, 01 Nov 2013 22:33:41 GMT

kindly find the link to below for the proper configuration sample for authorization.

https://supportforums.cisco.com/docs/DOC-16027

ACS configuration for Authorization

patrick.girigorie — Tue, 19 Nov 2013 11:42:13 GMT

This didn't seem like it was design for one user to get all the priv for Show command. So we decided to use two users instead one with priv 15 with no wr mem or conf t and another with priv 15 with no restrictions.

Thanks

Patrick