topic Re: AAA with CatOS and ACS (shell command autorization set) in Network Access Control

AAA with CatOS and ACS (shell command autorization set)

rdubo — Sun, 10 Mar 2019 22:30:55 GMT

Hi,

I have an ACS that authenticates and authorizes IOS devices.

I use "shell command autorization set" to authorize some commands for some groups.

Is it possible to do so with CatOS?

For example, I'd like that the groupe FULL can access all command and the group LOW can onmy access "sho" commands?

Regards,

ROMS

Re: AAA with CatOS and ACS (shell command autorization set)

Jagdeep Gambhir — Wed, 14 Nov 2007 22:32:13 GMT

Roms,

Concept remains the same for IOS and CAT OS. You need to define command author set for cat os.

Regards,

~JG

Re: AAA with CatOS and ACS (shell command autorization set)

rdubo — Thu, 15 Nov 2007 12:20:51 GMT

Hi,

Ok, and what should be the configuraio of the switches. I see there is few available command for CatOS...

Regards

Re: AAA with CatOS and ACS (shell command autorization set)

somishra — Thu, 15 Nov 2007 12:58:17 GMT

Hi,

The following command is reqd to enable command authorization on set-based switch:

set authorization commands enable [config | all] tacacs+ [deny | none] [console | telnet | both]

tnx

somishra

Re: AAA with CatOS and ACS (shell command autorization set)

Jagdeep Gambhir — Thu, 15 Nov 2007 14:02:52 GMT

Console> (enable) set tacacs server [IP] [primary]

set tacacs key [key]

set tacacs attempts [number] (optional)

set localuser user [user] password [password] privilege 15

set authentication login local enable

set authentication login tacacs enable [all | console | http | telnet] [primary]

set authorization exec enable tacacs+ [deny | none] [console | telnet | both]

set authorization commands enable [config | all] tacacs+ [deny | none] [console |telnet | both]

regards,

~JG

Re: AAA with CatOS and ACS (shell command autorization set)

Jagdeep Gambhir — Thu, 15 Nov 2007 14:10:22 GMT

Here is the sample screen shot. Also note that CAT OS do not support local AAA fallback until version 7.5 when the 'set localuser' command was introduced.

Regards,

~JG

Do rate helpful posts