topic prevent excecuting commands in Network Access Control

prevent excecuting commands

vos123 — Sun, 10 Mar 2019 20:53:08 GMT

We have a tacacs+ 3.2 server running on windows.

What do i need to prevent users excecuting commands like 'reload' and 'sh ip route' on the enable level.

and commands in the config mode ('no ip router bgp').

I'm looking for examples of configs on the router.

But most of all, how do I configure the tacacs+ server.

Greetings

Jeroen

Re: prevent excecuting commands

cdwyer — Wed, 10 Nov 2004 21:24:30 GMT

You will need to create a Shell Command Authorization Set. That is located Shared Profile Components/ Shell Command Authorization Sets. After you create a Shell Command Authorization Set, you need to apply it to the group that the user is a member of. On the router, you need to make sure it checks with the ACS server for every command entered. That is done with the command:

aaa authorization commands 15 default group tacacs+ none