topic Re: Authorization Question2 in Network Access Control

Authorization Question2

cannonscott — Sun, 10 Mar 2019 20:59:51 GMT

I have a small group of users that I want to allow access to a switch. I only want to allow them to do "show int status", "show run" and "show proc." What is the best way to set this up? Does the privlige level have to be set up on the switch or is this done on the ACS. The users are set up in a group called "UserSupport"

Re: Authorization Question2

nchopra79 — Tue, 01 Feb 2005 04:59:04 GMT

Hi,

Try this:

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a008009465c.shtml

Regards.

Re: Authorization Question2

cannonscott — Tue, 01 Feb 2005 14:15:43 GMT

That shows how to set up basic Authorization on the switch but dosen't help with setting privlige levels or command authorization.

Re: Authorization Question2

Kevin Dorrell — Tue, 01 Feb 2005 16:06:17 GMT

The top of the document tells you about the basic setup, but the example shows you how to set the privelege levels required to use certain router commands (in this case, level 7), and shows you how to set up the TACACS so that specific users have level 7 access (as opposed to the more normal level 1 or 15), so they can use those specific commands. You need to dig quite deep into the example, but the information is there.

But if you want a more detailed document, here is one:

http://www.cisco.com/en/US/products/sw/secursw/ps4911/products_tech_note09186a0080107cfd.shtml

Here is a document that tells you how to do it without a TACACS:

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml

Kevin Dorrell

Luxembourg