topic Hi, in Network Access Control

ACS Privilege Level and Command Sets

chrismenuey — Mon, 11 Mar 2019 06:27:38 GMT

Hi all,

I've been tasked with setting up ACS 5.6 to be able to authorize MS domain security groups members to have specific command access to our equipment. I've got the domain association and groups added, I have an Access Policy with a rule that is working so my domain test account can login to the switch and perform only the commands in my Command Set.

The issue is that when I assign a Shell Profile with privilege level 7 min/max to the rule, and the user logs in with this level, they are unable to see the commands that I've allowed in the Command Set. Is there a way to have ACS tell the IOS to automatically modify the commands visible to a specific privilege level when the user logs in, even though they aren't in that privilege level?

Any help greatly appreciated,

Chris Menuey

Since you're using command

Jatin Katyal — Tue, 09 Feb 2016 15:34:21 GMT

Since you're using command authorization and restricting user to certain commands, why are we using privilege 7 and not 15?

~Jatin

It was an attempt to limit

chrismenuey — Thu, 11 Feb 2016 04:22:32 GMT

It was an attempt to limit the commands visible to the junior technicians to keep them from being inundated with commands that won't have prevalence to what they need to do, assign access vlan numbers to ports, use show commands, etc. We were under the assumption that ACS would be able to do this automatically with priv 7 based on the commands we put in the command set, since it doesn't appear possible I'll just be using priv 15 and doing additional training to let them know that even though they can see it, doesn't mean they can use it 😄

Thanks for the confirmation of this Jatin, help is always appreciated 🙂

yw ! Here is a link to

Jatin Katyal — Thu, 11 Feb 2016 06:19:50 GMT

yw ! Here is a link to configure command authorization on ACS

~ Jatin

Hi,

Chris McCann — Wed, 18 May 2016 15:27:46 GMT

Hi,

I have a simular problem but using user authencation on the TACAS, cannt find were to associate the user with a specific profile.