topic Cisco ACS 5.3 - How to only allow specific AD groups to login in Network Access Control

Cisco ACS 5.3 - How to only allow specific AD groups to login

jeff.ortega — Mon, 11 Mar 2019 02:44:53 GMT

Can anyone help me figure out what I have wrong or have missing?

I've configured three specific AD groups, Admin, Storage, and HelpDesk, with their own commands sets.

This seems to be working fine, but everyone can log into everything, but they can't do anything except exit.

My goal is to not allow anyone to login that is not part of the three AD groups I have specified with the respective command sets.

All the logins hit the Admin account, even though the id in AD is not in the that AD group. I have something screwed up.

Cisco ACS 5.3 - How to only allow specific AD groups to login

Tarik Admani — Mon, 05 Nov 2012 21:42:56 GMT

Check your authorization rules, make sure the default rule isnt set to Permit. Group Mapping is only mapping AD groups to internal ACS groups, we need to check your authorization rules to see which policies they users are hitting, you may want to reset the hit count and test to see which policy is allowing access.

Thanks,

Tarik Admani
*Please rate helpful posts*

Cisco ACS 5.3 - How to only allow specific AD groups to login

jeff.ortega — Thu, 08 Nov 2012 17:28:42 GMT

Thank you. I found the problem with your assistance. Had the permit set. Then set it to DenyAccess.

Cisco ACS 5.3 - How to only allow specific AD groups to login

dpatzold1979 — Wed, 30 Jan 2013 01:36:07 GMT

I have a similar setup but i do not see a deny access authorization profile to use for the default. can you explain how you set the default to deny access

Re: Cisco ACS 5.3 - How to only allow specific AD groups to logi

minkumar — Wed, 30 Jan 2013 01:42:18 GMT

Under authorization, check the check box for default, click on Edit and select the deny access profile.

Regards

Minakshi (do rate the helpful post)

Re: Cisco ACS 5.3 - How to only allow specific AD groups to logi

dpatzold1979 — Wed, 30 Jan 2013 01:46:31 GMT

Somthing must be broken for my install of 5.4 because i do not have a deny access authorization profile.. only permit access

Re: Cisco ACS 5.3 - How to only allow specific AD groups to logi

dpatzold1979 — Wed, 30 Jan 2013 01:58:46 GMT

UG never mind.. you have to acctually click on select button to see the deny access profile which does not show up in the policy elements.. thanks man it worked.