topic Tacacs : Telnet Vs SSH in Network Access Control

Tacacs : Telnet Vs SSH

lni1 — Fri, 21 Feb 2020 18:57:16 GMT

Hello,

We are in the process of migrating our device access from Telnet to SSH using Tacacs+

In ISE (2.0 #6) we would like to create 2 different users, one user if access is done using Telnet, an other user if access is done via SSH.

Is there an attribute in the Tacacs+ authentication process in ISE were we can differentiate if a user is using Telnet or SSH?

Kind regards,

Lieven Stubbe

Belgian Railways

Re: Tacacs : Telnet Vs SSH

Rob Ingram — Fri, 01 Jun 2018 14:06:03 GMT

Hi,

I've had a quick look and don't think you can differentiate telnet/ssh protocols in a rule.

What you could do is create 2 separate AuthZ rules and use the condition "TACACS·User EQUALS xxxxxx" for telnet user and another rule for the ssh user, to differentiate between the users. xxxxx = equals the name of the user you create for telnet/ssh.

HTH

Re: Tacacs : Telnet Vs SSH

lni1 — Fri, 01 Jun 2018 14:20:31 GMT

Hello RJI,

Can you elaborate the AuthZ solution a little more? I don't quite get it...

The one user should only be used for Telnet and the other for SSH

Lieven

Re: Tacacs : Telnet Vs SSH

Rob Ingram — Fri, 01 Jun 2018 14:43:46 GMT

Ah ok, sorry I mis-understood/mis-read, I don't think you can distinguish between telnet/ssh. My suggestion was to merely differentiate the user authentications, which could then be used for different levels of AuthZ.

Re: Tacacs : Telnet Vs SSH

hslai — Sun, 03 Jun 2018 06:00:49 GMT

It seems possible with ASA. See Device Policy Sets - tacacs ports 443 and 22

This depends on the T+ implementation on the network device platforms.