topic ACS authorization in Network Access Control

ACS authorization

abukuru95 — Mon, 11 Mar 2019 02:16:34 GMT

Hi there,

I have an issue with ACS 5.3. i have configured different user groups and different devices., integrated it with active directory and all seems to be working good.

internal users and AD users are successfully authenticated and the authorization policies applied well(read only or full access).

the problem is with a few firewall devices. i have an account with full access to devices but when i connect, i cannot have access to the enable commands.

when i look deep into the logs, i see that the default deny all selected command set is applied as shown in the diagram below.

i cannot find where to associate users to another command set.

i can successfully associate user groups to a shell profile but not a command set. does anybody out there know where this can be done?

thanks in advance

ACS authorization

mauzamor — Fri, 06 Jul 2012 19:57:23 GMT

Hi there,

If you could send us screenshots of your Device-Administration/Authorization settings it will be easier to find the root of the problem.

This could be related to an incorrect Access Policies rules configuration or that when you are connecting with the firewalls you are hitting an Access Policy that doesn't have the Command Sets option enabled, check if your "Device-Administration" rule has the Command Set option enabled:

ACS authorization

abukuru95 — Fri, 06 Jul 2012 20:02:35 GMT

Hi Mauricio,

i actually just did what you are sending highlighted in red. i added the command set using the customizable button and it is now working.

i guess when a device is configured for authorization, the command set must be included?

any way, thanks for the help and fast reply.

ACS authorization

mauzamor — Fri, 06 Jul 2012 20:07:42 GMT

Yep, that's correct. Everytime that you involved Command Authorization in your AAA clients you will need to send back a Command Set back to the client (IOS, firewall, etc.)

Glad I could help, enjoy the weekend!