Authorization Problem.

honggangli — Sun, 10 Mar 2019 20:50:03 GMT

I use the CISCO Secure ACS 3.3 for windows and 2511 as a Network Access Server with sixteen host map for reverse-telnet. All people use the reverse-telnet connect to my routers. i just want some people can login a part of the routers. I look for some case. but all configuration is for UNIX version. How can config the Windows version ACS authorization user use some host map.

thanks.

Re: Authorization Problem.

wong34539 — Thu, 07 Oct 2004 20:27:31 GMT

This might give you some idea,

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/index.htm

Re: Authorization Problem.

scottosan — Fri, 08 Oct 2004 13:30:04 GMT

If you only want certian people to have access to certian devices or certian commands on certian devices, you are going to have to do several things. FIrst you are going to have to use TACASS+ because RADIUS does not support "SHELL COMMAND AUTHORIZATION SETS". You can set this up through the "Shared Profile Components" tab. Here you can specifiy what commands people have access to. Next you have to assign the devices to "Network Device Groups" and users to specific groups. Under the group settings, go to "TACACS+ Setting". Check the Shell(Exec) box and the Privilege level box and assign it to 15. Scroll down to the Shell Command Authorization Set area. Choose the "Assign a Shell Command Authorization Set on a per Network Device Group Basis" option. Here you can assign a specific shell command authorization set to a specific network device group.

Then you must configure you device(s) to use this function. Your config should look something like this:

aaa new-model

aaa authentication login default group tacacs+ line

aaa authorization exec default group tacacs+ if-authenticated

aaa accounting exec default start-stop group tacacs+

aaa authorization config-commands

aaa authorization commands 0 default group tacacs+ if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 0 default stop-only group tacacs+

aaa accounting commands 1 default stop-only group tacacs+

aaa accounting commands 15 default stop-only group tacacs+

tacacs-server host x.x.x.x key ***********

end

Re: Authorization Problem.

mark.webster — Wed, 19 Oct 2005 13:40:47 GMT

What if I don't have access to a TACACS+ server? Can it be done in IOS on the box?

topic Re: Authorization Problem. in Network Access Control

Authorization Problem.

Re: Authorization Problem.

Re: Authorization Problem.

Re: Authorization Problem.