topic Re: couldn't get command set working on acs5.3 in Network Access Control

couldn't get command set working on acs5.3

kerim mohammed — Mon, 11 Mar 2019 02:50:42 GMT

Hi,

I configured, command set on ACS5.3 so that it allows to run the show command only. The corresponding shell profile is set to privelege level 15. I couldn't get it working. users are still able to run any command. how do i get this working.

Thanks,

Kerim

couldn't get command set working on acs5.3

mauzamor — Thu, 29 Nov 2012 16:03:28 GMT

Hi there,

Which is your current AAA configuration in the client? Type "show runn | i aaa" and paste here the output. Also share with us a screenshot of your Command Set and Authorization rule.

Re: couldn't get command set working on acs5.3

kerim mohammed — Thu, 29 Nov 2012 17:02:33 GMT

this is the command set:

Authorization: the last one

Authorization profile (shell profile):

thanks,

Let me know if you need more info.

Re: couldn't get command set working on acs5.3

mauzamor — Thu, 29 Nov 2012 17:25:49 GMT

You are missing the "authorization" commands.

For example depending on what you need to check with ACS you will have to use:

aaa authorization command 15 default group tacacs+ if-authenticated

aaa authorization command 1 default group tacacs+ if-authenticated

aaa authorization command 0 default group tacacs+ if-authenticated

The previous commands means that every time a user enters a command level 15/1/0 the client will check with the ACS if these commands are permitted or not.

Also, in the Command Set you don't need to use "*" in the Argument section, just "show" under the Command section.

Remember to have a back door configured, this will avoid you getting locked out, e.g. console access.

Let me know how it goes.

Re: couldn't get command set working on acs5.3

kerim mohammed — Thu, 29 Nov 2012 18:19:50 GMT

thanks! that took care of it.

Re: couldn't get command set working on acs5.3

mauzamor — Thu, 29 Nov 2012 18:29:04 GMT

Glad to hear the good news.

Have a nice day.