topic Re: NVRAM/Startup-config Security in Network Access Control

NVRAM/Startup-config Security

aquadisco — Mon, 11 Mar 2019 00:27:44 GMT

How can i prevent a user from writing to the startup-config?

Re: NVRAM/Startup-config Security

Javier Henderson — Mon, 04 Oct 2010 15:55:57 GMT

Using command authorization and denying that user the execution of "copy running-config startup-config" (and other variations of same, i.e. "write memory", etc)

Re: NVRAM/Startup-config Security

Shilpa Gupta — Mon, 04 Oct 2010 16:06:14 GMT

Hello,

Here are some links for command authorization which might be helpful for you:-

ACS Shell Command Authorization Sets on IOS and ASA/PIX/FWSM Configuration Example

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

Configuring Command Authorization on ASA:-

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/access_management.html#wp1042034

Configuring Command authorization on router:-

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800946a3.shtml#t1

Thanks,

Shilpa

Re: NVRAM/Startup-config Security

aquadisco — Mon, 04 Oct 2010 20:09:44 GMT

Good comments so far, but i need a little more hand holding as some of the options don't seem to be available on my configuration. Is this approach dependent on a TACACS server?

Here is some background information that i should have supplied originally.

Using 2811 router with Advanced Enterprises Services IOS
Would like to restrict users from changing the startup-config without use of the external AAA systems (TACACS, etc).

Thanks!