topic ise 2.4 command sets for nexus access in Network Access Control

ise 2.4 command sets for nexus access

Meuserid1979 — Tue, 24 Jul 2018 08:48:22 GMT

Hi Experts,

i was trying to configure tacacs for nexus access using ise 2.4. on the command sets for readonly access i only allowed a few commands for testing but after logging in, i can also use the other commands although they were not set on the tacacs command sets. only show int status and exit was set but other command like show vlan can be excuted. i can even execute "conf t" . any guide on how to configure the command sets for nexus ?

tia,

chris

Re: ise 2.4 command sets for nexus access

Alex Pfeil — Tue, 24 Jul 2018 10:22:51 GMT

Will this work for you? This will allow all show commands, but will not allow configuration commands. I have not tried limiting to specific commands.

Re: ise 2.4 command sets for nexus access

Meuserid1979 — Tue, 24 Jul 2018 10:32:30 GMT

Hi Alex,

thanks for the reply. yes i tried this and applied for each authz as per my screenshot. there are difference when loggin in as "administrator" and "readonly" but seems like limiting the commands(for read only access) which is applied on the command set portion of the authz doesnt work? coz i still can execute lots of commands which should be filtered by command sets. not sure whether its a normal nexus behavior? thanks

chris

Re: ise 2.4 command sets for nexus access

Alex Pfeil — Tue, 24 Jul 2018 17:03:08 GMT

Make sure that the correct authorization commands are enabled on the Nexus device and check out the PDF of the guide available here:

https://community.cisco.com/t5/security-documents/how-to-ise-tacacs-configuration-for-cisco-nx-os-network-devices/ta-p/3631609

Thanks,

Alex