topic local username database, restrict user access to cli in Network Access Control

local username database, restrict user access to cli

ngtransge — Mon, 11 Mar 2019 02:14:05 GMT

Hello,

I am interesting if it is possible to restrict cli access to users from local database, they should be working only for EasyVPN ?

Is it possible to do this without exsternal db ?

local username database, restrict user access to cli

Jatin Katyal — Mon, 25 Jun 2012 13:53:19 GMT

Could you elaborate your question?

What device are we using for authenticating users like version, model, platform?

Which CLI access are you refering here...CLI access to your switches/routers/firewalls?

Regards,

Jatin

local username database, restrict user access to cli

ngtransge — Mon, 25 Jun 2012 16:21:55 GMT

Hello Jatin,

I am using 3945E Router as Easy VPN Server, with 15.1 IOS. On router I have bunch on usernames for VPN authentication, I want to restrict Router management access for them(ssh,telnet, http and so on).

local username database, restrict user access to cli

Jatin Katyal — Mon, 25 Jun 2012 20:09:47 GMT

You can setup local command authorization for the same.

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml

Regards,

Jatin

Do rate helpful posts-

local username database, restrict user access to cli

ngtransge — Mon, 25 Jun 2012 21:19:00 GMT

how can I use these command ?

local username database, restrict user access to cli

ngtransge — Wed, 27 Jun 2012 07:09:01 GMT

Hello,

Early I saw one example when it was done with aaa atribute list, and it was working, but on 3945E it is not working.

Here is example :

aaa new-model

aaa authentication login ezvpn_users local

aaa authorization network ezvpn_users local

aaa attribute list ezvpn_users

attribute type service-type noopt service shell mandatory

username user1 password 0 superpasword

username user1 aaa attribute list ezvpn_users

Do you have some information about it ?

local username database, restrict user access to cli

Archil Sokhadze — Fri, 19 Oct 2012 13:12:07 GMT

try

"aaa authorization exec default local"

local username database, restrict user access to cli

bejoybkn1 — Sat, 20 Oct 2012 14:09:03 GMT

I think there is an easy way

define the user with privilege 0

That should do

Users can still login but they cant access/manage the router