topic Re: ISE/Radius & Network Device Read Only in Network Access Control

ISE/Radius & Network Device Read Only

jhaddix385 — Fri, 21 Feb 2020 19:03:49 GMT

We use our ISE server as a Radius/TACACS for our network devices. Does ISE (if so how) could you configure users on ISE to only have read-only (show commands) on network devices registered to ISE

Re: ISE/Radius & Network Device Read Only

paul — Fri, 15 Mar 2019 19:25:30 GMT

You have to use TACACS to do this efficiently. You would configure the device for TACACS command authorization (in addition to authentication and accounting).

aaa authorization commands 15 default group ISE-TACACS if-authenticated

There is not need to authorize anything but level 15 commands. You should account for level 0, 1 and 15 though in the accounting setup:

aaa accounting commands 0 default stop-only group ISE-TACACS

aaa accounting commands 1 default stop-only group ISE-TACACS

aaa accounting commands 15 default stop-only group ISE-TACACS

Depending on your switch the TACACS syntax will be different. Once you have command authorization enabled you would configure a command set in ISE that allows "show" command. All other level 15 commands will be denied. Tie that to your desired TACACS rule for the group of users you want to have read-only access. Setup a TACACS profile that assigned priv level 15 and max priv level 15 to the users as well.

Re: ISE/Radius & Network Device Read Only

BrianPersaud — Thu, 27 Jun 2019 19:46:30 GMT

Is there a way to do this with radius? I don't have tacacs licenses on ISE.

Re: ISE/Radius & Network Device Read Only

Jason Kunst — Thu, 27 Jun 2019 20:24:18 GMT

as he said not too efficiently, would recommend tacacs, we don't recommend radius as its very limited therefore don't spend much time on it
some thread discussions
https://www.google.com/search?q=ise+radius+device+administration&oq=ise+radius+device+&aqs=chrome.0.0j69i57j0j69i60j69i64.2540j0j7&sourceid=chrome&ie=UTF-8
https://community.cisco.com/t5/policy-and-access/device-administration-using-radius-cisco-ise-2-3/td-p/3309882