topic CLI Access control with Radius only in Network Access Control

CLI Access control with Radius only

estidd — Mon, 03 Jun 2019 18:47:18 GMT

Hello,

Are we able to do CLI access control with Radius only? I have seen 3rd party examples on ise 1.x but nothing for 2.x and nothing official. Goal would be to control exec level access to Catalyst, ISR, and nexus devices with Radius only. No TACACS license required.

-Eliott

Re: CLI Access control with Radius only

yalbikaw — Mon, 03 Jun 2019 21:53:43 GMT

Hello Eliot,

of course you should be able to do this,

please check this document

https://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/115926-tacacs-radius-devices-00.html#asr

i know its for ACS but very much same concept, the idea is to use cisco-av pair on the authorization result and mention the attribute you would like to push.

take a look and if you faced some challenges feel free to ask.

Wishes.

Re: CLI Access control with Radius only

Arne Bier — Tue, 04 Jun 2019 12:46:52 GMT

I can confirm that as long as the network device allows Device Admin using the Radius protocol, then ISE will happily oblige. Cisco WLC and IOS devices all support this. For ISE it's just a PAP authentication. You need to figure out what attributes the NAS will include in its Access-Request and then catch that in your Policy Set Authorization Rules.

Below is what I figured out recently when I had to do this.