topic Re: Adding a user role for SAN switches in Network Access Control

Adding a user role for SAN switches

edward.gillston — Sun, 10 Mar 2019 22:21:15 GMT

I am trying to find the correct location in ACS 3.3 to add the following: roles="network-admin". We have our SAN switches using Tacacs+. When a user other than admin logins, you get the role as "network-operator". This doc Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x explains the role if you are using IOS/PIX Radius. Thank you.

Re: Adding a user role for SAN switches

Jagdeep Gambhir — Thu, 23 Aug 2007 14:57:58 GMT

Hi Ed,

Here is the link,

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/sw/rel_2_x/san-os/configuration/guide/cradtac.html

If you search for:

TACACS+ custom attributes can be defined on an Access Control Server (ACS) for various

services (for example, shell). Cisco MDS 9000 Family switches require the TACACS+ custom

attribute for the service shell to be used for defining roles.

Cisco ACS TACACS+

shell:roles="network-admin"

shell:roles*"network-admin"

cisco-av-pair*shell:roles="network-admin"

cisco-av-pair*shell:roles*"network-admin"

cisco-av-pair=shell:roles*"network-admin"

On the ACS, if you go to: Interface configuration, TACACS+ (Cisco IOS), place a check nex to: " Display a window for each service selected in which you can enter customized TACACS+ attributes".

Then go into Group Setup and define the role information according to the above attributes.

Hope that helps

Regards,

~JG

Re: Adding a user role for SAN switches

edward.gillston — Thu, 23 Aug 2007 15:59:19 GMT

That was the solution. Thank you

Re: Adding a user role for SAN switches

Jagdeep Gambhir — Thu, 23 Aug 2007 16:01:46 GMT

Ed,

Nice to know that. Please mark it resolved so other can benifit from it.