topic Re: Cisco ACS command authorization sets in Network Access Control

Cisco ACS command authorization sets

rod.blackie — Sun, 10 Mar 2019 20:55:08 GMT

I need help on the following please.

1. - I am using ACS as TACACS server to control IOS authorization on all our Switches, However I can not deny telnet sessions to other devices from within CatOS - does anyone know the command authorization set to deny this within ACS ????

2. Does anyone know where I can read up on command authorizations sets for ACS ??

3. What is the debug command for CatOS to see cli output ?

Many thanks

Rod

Re: Cisco ACS command authorization sets

risgro — Wed, 08 Dec 2004 00:08:33 GMT

For#1 - No idea on catOS

For #2 - http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/c.htm#wp697557

(only a bit of pattern matching)

For #3 you can look in TACACS+ Administration file or Failed Attempts active.csv on your ACS to what the AAA client is sending to the ACS for authorization

Re: Cisco ACS command authorization sets

rod.blackie — Wed, 08 Dec 2004 09:51:36 GMT

Thanks for your info. I have solved my problem -

1. I enabled tacacs administration logging using command on switch aaa authorization commands 15 default group tacacs+

This let me see what what happening everytime I entered a command on CatOS - via the logging monitor on ACS. From here i was able to see that when i was trying to telnet to a device from CatOS it was doing it on Privilage mode 1. I then entered this command aaa authorization commands 1 default group tacacs+ which solved my telnet problem.

Problem resolved.

Many thanks.