topic Re: Command Authorization in Network Access Control https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970132#M419506 <HTML><HEAD></HEAD><BODY><P>It should be</P><P></P><P>configure----&gt; on the left box</P><P></P><P>permit terminal ---&gt; on the right box.</P><P></P><P></P><P></P></BODY></HTML> Mon, 02 Jun 2008 16:00:37 GMT Jagdeep Gambhir 2008-06-02T16:00:37Z Command Authorization https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970129#M419503 <P>I have ACS solution engine, I have applied a command authorization set on user, below mention is command authorization set </P><P></P><P>show command </P><P>permit version</P><P>permit aaa</P><P>permit config</P><P>permit interface</P><P>permit xlate</P><P>permit nat</P><P>permit global</P><P>permit access-list</P><P>permit route</P><P>permit ip route</P><P>permit vlan brief</P><P>permit ping</P><P></P><P></P><P>Clear command </P><P>permit version</P><P>permit aaa</P><P>permit config</P><P>permit interface</P><P>permit xlate</P><P>permit nat</P><P>permit global</P><P>permit access-list</P><P>permit route</P><P>permit ip route</P><P>permit vlan brief</P><P></P><P></P><P>enable command</P><P>permit ping</P><P></P><P></P><P>now problem is that user is able to login successfully, and goes to enable mode, but from neither mode he is able to ping the network. </P><P></P><P>though i have allowed the ping command, but user getting error </P><P></P><P>ping 172.28.95.2</P><P>Command authorization failed</P><P></P><P>I want to allow the user to ping anywhere in the network. </P><P></P><P>Please tell me how to do that. </P> Sun, 10 Mar 2019 22:52:52 GMT https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970129#M419503 wasiimcisco 2019-03-10T22:52:52Z Re: Command Authorization https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970130#M419504 <HTML><HEAD></HEAD><BODY><P>To allow ping , this is how command set should be configured.</P><P></P><P>See attachment</P><P></P><P>Regards,</P><P>~JG</P><P></P><P> </P><P></P></BODY></HTML> Mon, 02 Jun 2008 12:58:27 GMT https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970130#M419504 Jagdeep Gambhir 2008-06-02T12:58:27Z Re: Command Authorization https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970131#M419505 <HTML><HEAD></HEAD><BODY><P>It was not working as mentioned in the attachement, I changed it to to different way as shown in the snapshot, it is working now.</P><P></P><P>Please tell me one more thing, if i want user to even allow configure terminal, how to do that, i tried as mentioned in the snapshot but not working, I want user to go into configure terminal but i will only allow the commands that i mentioned in the show command set.</P><P></P><P>Please tell me how to do that. </P><P></P><P> </P><P></P></BODY></HTML> Mon, 02 Jun 2008 15:41:13 GMT https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970131#M419505 wasiimcisco 2008-06-02T15:41:13Z Re: Command Authorization https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970132#M419506 <HTML><HEAD></HEAD><BODY><P>It should be</P><P></P><P>configure----&gt; on the left box</P><P></P><P>permit terminal ---&gt; on the right box.</P><P></P><P></P><P></P></BODY></HTML> Mon, 02 Jun 2008 16:00:37 GMT https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970132#M419506 Jagdeep Gambhir 2008-06-02T16:00:37Z Re: Command Authorization https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970133#M419507 <HTML><HEAD></HEAD><BODY><P>Waseem, have a look at the following link:</P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml" target="_blank">http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml</A></P><P></P><P>The best option is to turn on the following debugs on the router and then enable the appropriate commands in ACS (as sometimes router is sending strange characters like <CR> etc)</CR></P><P></P><P>debug aaa authorization</P><P>debug tacacs</P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Mon, 02 Jun 2008 18:15:48 GMT https://community.cisco.com/t5/network-access-control/command-authorization/m-p/970133#M419507 Farrukh Haroon 2008-06-02T18:15:48Z