topic ACS 5.2 - Unable to Map Command Set to Shell Profile in Network Access Control

ACS 5.2 - Unable to Map Command Set to Shell Profile

millerdl — Mon, 11 Mar 2019 02:09:36 GMT

Hi everyone,

I am in the process of setting up ACS 5.2 for a network and have run into an issue when attempting to apply the following aaa commands to a network device:

aaa authorization exec default group tacacs+ local if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ local if-authenticated

Once the commands have been applied to the device configuration I get "command authorization failed" when attempting to do anything. Taking a quick look at the TACACS Authorization reports I see a failure reason of "13025 Command failed to match a Permit rule" and under the Selected Command Set "DenyAllCommands" is listed.

After doing a bit of searching, I noticed some articles online that indicate I should be able to specify the appropriate command set to the authorization profile under the Default Device Admin policy. However, when I open up a Device Aministration Authorization Policy, nowhere in the window does it display command sets that I can select from.

Any thoughts? Is there something I'm missing somewhere else? Thank you in advance for your assistance.

ACS 5.2 - Unable to Map Command Set to Shell Profile

mauzamor — Fri, 01 Jun 2012 17:28:36 GMT

Hi there,

This is a very common situation, the problem here is that the Command Set option is not enabled by default. You need to customize the Authorization page using the "Customize button" at the bottom right of the page. Move the "Command Set" option to the right and click Submit, check the screenshots below:

After that you will be able to assign the "Command Set" value.

Rate if it helps!

ACS 5.2 - Unable to Map Command Set to Shell Profile

millerdl — Fri, 01 Jun 2012 21:17:08 GMT

Thank you kindly Mauricio! That remedied the issue and I'm now in business.

Best Regards,

Dan Miller

ACS 5.2 - Unable to Map Command Set to Shell Profile

alexandersoliz — Fri, 24 Aug 2012 15:45:08 GMT

Thank you mauricio!!!, I was like 2 hours trying to figure out by my seft! but I couldnt, Why isnt this option enabled by default!!

ACS 5.2 - Unable to Map Command Set to Shell Profile

lmediavilla — Thu, 30 Aug 2012 07:44:24 GMT

Thank you, this has helped me a lot!