topic Re: AAA Different Permissions again in Network Access Control

AAA Different Permissions again

networker99 — Sun, 10 Mar 2019 23:39:28 GMT

In a previous post I asked how I could assign RO permissions when a user connects to a firewall, but RW access when they connect to a switch, I was given a Cisco Kb to follow but this only allows the user to be in a RO or RW group.. I need the same user "Joe Blogs" RO access for one device and RW for another.

Re: AAA Different Permissions again

Jatin Katyal — Thu, 20 Aug 2009 14:23:12 GMT

This is what I explained you in my last update to your POST.

Please check again.

Plz let me know if you face any issue.

Regards,

Re: AAA Different Permissions again

networker99 — Thu, 20 Aug 2009 15:03:23 GMT

I followed your post but how does it know when to use the RW group as opposed to the RO group?.. I can only place the user in one group..

Re: AAA Different Permissions again

Jatin Katyal — Thu, 20 Aug 2009 15:56:39 GMT

This can be done by creating two NDG's and map them with respective command authorization set under the same user account.

Creating NDG's

----------------

NDG1 for ASA ---add ASA as a aaa client

NDG2 for switch---add switch as aaa client.

Creating command authorization set

----------------------------------

Create two different command authorization set under shared profile component for

Switch = permit all

ASA = Deny all

and permit show only

Now, under the user account you need to map the NDG with appropriate command authorization set. When user tries to login to switch/ASA it will check the authorization set mapped with their NDG's

Regards,

Re: AAA Different Permissions again

networker99 — Thu, 20 Aug 2009 16:09:55 GMT

"Now, under the user account you need to map the NDG with appropriate command authorization set." I cant see how to do this.

Re: AAA Different Permissions again

Jatin Katyal — Thu, 20 Aug 2009 16:41:26 GMT

Under the user account >> Look for this radio option

Assign a Shell Command Authorization Set on a per Network Device Group Basis.

Attached is the screen shot of the same.

Re: AAA Different Permissions again

networker99 — Thu, 20 Aug 2009 16:52:08 GMT

Doesnt exist in version 4.1

Re: AAA Different Permissions again

Jatin Katyal — Thu, 20 Aug 2009 17:17:23 GMT

This does exist in 4.1.x

You need to enable this feature on the ACS under interface configuration > Advanced Options > check this option "Per-user TACACS+/RADIUS Attributes"

After that click on cancel > go to TACACS+ (Cisco) > check this option "Shell (exec)" for user > hit submit and you are done 🙂

Re: AAA Different Permissions again

networker99 — Thu, 20 Aug 2009 17:29:09 GMT

Thanks, but I only have

-None

-As Group

-Assign a Shell Command Auth for any network device

-Per User command authorization

I dont have "Based on per network device group basis"

Re: AAA Different Permissions again

networker99 — Thu, 20 Aug 2009 17:41:28 GMT

Got it !! didnt have NDG selected under interface options