topic Re: Command Authorization in ACS in Network Access Control

Command Authorization in ACS

waridtel.com — Sun, 10 Mar 2019 21:52:54 GMT

Hi,

Can anybody tell me how can I permit only ping command to a group in ACS. What is the actual statement that I want to add in command authorization sets.

Re: Command Authorization in ACS

premdeep.banga — Fri, 15 Dec 2006 06:15:55 GMT

Hi,

Please refer the attachment for detail.

After you have gone through the attachment, Being specific to your question,

ping---------------(Check the check box for "Permit unmatched Args")

Regards,

Prem

Re: Command Authorization in ACS

waridtel.com — Fri, 15 Dec 2006 09:56:21 GMT

Hi,

Thanks a lot.

Re: Command Authorization in ACS

premdeep.banga — Sat, 16 Dec 2006 03:37:08 GMT

Do rate if that helps.

😉

Regards,

Prem

Re: Command Authorization in ACS

royalblues — Sun, 24 Dec 2006 11:50:57 GMT

Hi Prem,

Can you let me know how can i restrict a group from adding a route. I have the following configured on the ACS under shell authorization

configure ......permit terminal

interface ......permit fastethernet (permit Unmatched arg)

show............permit vlan

switchport......permit access &

permit vlan

With the above configuration iam still able to add a route to the config

Also i would like to know the wildcard to be used for enabling all the fastethernet or Ge ports

thanks in advance

Narayan

Re: Command Authorization in ACS

Vivek Santuka — Tue, 26 Dec 2006 23:30:23 GMT

Narayan,

This command will help in restricting the route addition :-

aaa authorization config-commands

Command authorization does not apply to configuration mode automatically. So we need to enable it using the above command.

Re: Command Authorization in ACS

royalblues — Wed, 27 Dec 2006 07:45:34 GMT

Hi Vivek,

I had the command in my configuration.

Actually i had missed the command

aaa authorization commands 15 default group tacacs+ local

Thanks

Narayan