topic Re: ACS Shell Command Authorization Set + restricted Access in Network Access Control

ACS Shell Command Authorization Set + restricted Access

vineethmohan — Mon, 11 Mar 2019 00:48:12 GMT

Hi ,

I have tried to Create a restricted Access Shell Command Authorization Set on ACS as told on the Cisco Url

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

After I applied the same on a User Group I found the users on the group have complete access after typing the conf t on the equipments . My ultimate aim was restrict the access only at Interface level , Attached is the config details . Could anyone has come across such scenario . Please check my config and let me know any thing need to be done specially from My Side

Thanks in Advance

Regards

Vineeth

Re: ACS Shell Command Authorization Set + restricted Access

Jatin Katyal — Wed, 09 Feb 2011 00:38:36 GMT

You have missed this command in your configuration

aaa authorization config-commands

Rgds, Jatin

Do rate helpful posts~

Re: ACS Shell Command Authorization Set + restricted Access

vineethmohan — Thu, 10 Feb 2011 07:51:25 GMT

Hi Jatin ,

first of all Thank you very much . It startted working after aaa authorization config-commands

here I was trying to achive one specfic thing .

I want to stop the following commands on ACS “switchport trunk allowed vlan 103” . I only want allow “add” after “vlan” and block rest all arguments

But even after setting the filter on ACS Still we are able to execute the command is there anything like we cannot control the commands after the sub commands

Also I am attaching the filter list along with this. Could you have look on this and let me know whether I have configured something wrongly. Other than this is there any work around is available to achieve this .

Thanks and Regards

Vineeth

Re: ACS Shell Command Authorization Set + restricted Access

Jatin Katyal — Thu, 10 Feb 2011 10:50:35 GMT

In order to achieve the required result of denying the command:

"switchport trunk allowed vlan "

Command would be : switchport

Add this argument for the switchport command deny trunk allowed vlan 103

And check the box which says "permit unmatched argument".

This way all other switchport commands will be allowed by default except the one which we have denied.

Rgds, Jatin

Do rate helpful posts~