topic Re: How do I create a non-administrative RADIUS user? in Network Access Control

How do I create a non-administrative RADIUS user?

alemanetz — Fri, 21 Feb 2020 19:04:37 GMT

Hello, I have some Cisco 2960X switches in which I authenticate using RADIUS.

I was wondering if there's a way to create a non-administrative user for them using a RADIUS server?

This user should only execute the following commands: show interface status, duplex <mode>, switchport, description, shutdown and no shutdown.

Is this possible?

Re: How do I create a non-administrative RADIUS user?

luis_cordova — Tue, 16 Apr 2019 00:10:33 GMT

Hi @alemanetz ,

Maybe this discussion of the community can help you:

https://community.cisco.com/t5/firewalls/privilege-level-assignment-via-radius/td-p/2221818

Regards

Re: How do I create a non-administrative RADIUS user?

Damien Miller — Tue, 16 Apr 2019 00:52:17 GMT

If the RADIUS server that you are using is ISE, then it is commonly done with TACACS.

You create a shell profile for the device, a command set (limiting commands), and then an authentication and authorization rule that the user/switch matches. This is a good graphical guide showing an example.
https://networkproguide.com/configure-cisco-ise-tacacs-server/

If the RADIUS server you are using doesn't offer TACACS, it still possible to restrict authentication users from accessing config t, just a different guide.

Re: How do I create a non-administrative RADIUS user?

alemanetz — Tue, 16 Apr 2019 13:39:32 GMT

Thanks for your answer!

I'm using NPS as my RADIUS server. How would I go around this?