topic ACS 5.x "do" commands in Command Set in Network Access Control

ACS 5.x "do" commands in Command Set

MICHAEL BURNS — Fri, 21 Feb 2020 18:39:40 GMT

I am having an issue allowing "do" show commands in the command set.

Specifically I want users to be able to issue:

"do show run interface *"

I cannot get the "do" portion to work. Would I have "do show" in the command portion? Or would I just have "do" in the command portion and "show run interface *" in the argument portion?

***Edit***

I found in ACS logs that ACS sees it come across as "do-exec" instead of just "do". Using that, I have "do-exec" in the command field and "sh* run" in the argument field. All good now!

Re: ACS 5.x "do" commands in Command Set

Flavio Miranda — Mon, 20 Nov 2017 21:26:20 GMT

Do command is present in IOS based device.If get error by trying to using if, probably have no support.

-If I helped you somehow, please, rate it as useful.-

Re: ACS 5.x "do" commands in Command Set

Arne Bier — Tue, 21 Nov 2017 00:21:18 GMT

That's an interesting observation. Not sure how ACS works but in ISE this is possible, since the command uses wildcards, and the arguments use regular expressions. I tested this in ISE 2.3

PASSED authorization examples:

sh runn

show ru

conf t

exit

do sh ru

do show clock

FAILED examples

do reload

show version

Re: ACS 5.x "do" commands in Command Set

MICHAEL BURNS — Tue, 21 Nov 2017 03:58:30 GMT

Solved.

ACS sees all "do " commands as "do-exec". By changing the command to "do-exec" and adding "sh* run" it fixed the issue.