topic Re: ISE 2.4 Command set not working in Network Access Control

ISE 2.4 Command set not working

Firepowered — Tue, 15 Oct 2019 12:47:00 GMT

I want a simple command set, permit some commands (eg: show, dir, ping, traceroute ) but deny en or enable, intended that the user should never go to enable mode. My command set is as follows

TACACS Profile

PS: Doesn't matter what priv level I use here.

Configuration on the ASA

aaa-server TACACS protocol tacacs+
aaa-server TACACS (inside) host x.x.x.x
aaa authentication ssh console TACACS LOCAL
aaa authentication http console TACACS LOCAL
aaa authentication serial console LOCAL
aaa authorization command TACACS LOCAL
aaa accounting ssh console TACACS
aaa authorization exec authentication-server
aaa authentication login-history

I read somewhere to enable 'aaa authorization config-commands' but I don't have that on my ASA (9.8)

What am I doing wrong?

Re: ISE 2.4 Command set not working

paul — Tue, 15 Oct 2019 13:15:22 GMT

In my opinion the concept of enable mode is a legacy concept that I haven't used in years with any of my customers. If you have command authorization enabled via TACACS it doesn't matter what mode you are in, you are authorizing and accounting for everything that is typed in. I have my customers send all users to the # prompt and then we authorize from there.

Re: ISE 2.4 Command set not working

Firepowered — Tue, 15 Oct 2019 13:34:30 GMT

Thank you, this is good.

I allowed priv users to enter exec mode on login and restricted commands, this works as expected. Do you know what the min / max priv level required for user to auto move to exec upon login? (1 didn't work, I moved to 5 and it worked, but that was random)

Btw, I am curious, why does the existing command set not work?

Re: ISE 2.4 Command set not working

paul — Tue, 15 Oct 2019 14:54:01 GMT

Just send everyone to priv 15 (min and max) and do command authorization. On the ASA you need to add.

aaa authorization exec authentication-server auto-enable

You had the command but didn't have the auto-enable key word at the end.

That will allow users directly into the # prompt. I am not sure why your command set didn't work. Would have to do further analysis on that.

Re: ISE 2.4 Command set not working

Firepowered — Tue, 15 Oct 2019 15:39:00 GMT

Thanks.

I meant to ask why the initial config for denying 'enable' after login doesn't work.