topic Re: Cisco ISE Tacacs Policies Set in Network Access Control

Cisco ISE Tacacs Policies Set

PutmanoAIT — Fri, 21 Feb 2020 18:51:32 GMT

I have configure Cisco ISE for TACACS server. I configured command set to limit some show command and shell profile to maximum the privilege to 7 for HelpDesk Admin. The command set policy is working fine but shell profile seem not working. I logged into the switch and show privilege, I'm still in privilege 15.I'm not sure where I'm wrong. Please kindly see the switch configuration as below:

tacacs-server timeout 1
tacacs-server host 10.156.141.69
tacacs-server key 0 P@ssw0rd

aaa authentication login default group tacacs+ local none
aaa authentication enable default group tacacs+ local none
aaa authorization config-commands
aaa authorization exec ISE group tacacs+ local none
aaa authorization commands 0 default group tacacs+ local none
aaa authorization commands 1 default group tacacs+ local none
aaa authorization commands 7 default group tacacs+ local none
aaa authorization commands 15 default group tacacs+ local none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 7 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

line vty 0 4
authorization exec ISE
transport preferred ssh
transport input ssh

line vty 5 15
authorization exec ISE
transport preferred ssh
transport input ssh

Re: Cisco ISE Tacacs Policies Set

Francesco Molino — Fri, 23 Mar 2018 02:38:49 GMT

Hi

Can you share the policy you're pushing from your tacacs server?

Just for your information. If you want to use privilege levels it has to be configured locally the device if you're pushing level 7 from tacacs.

Using tacacs you can push level 15 and filter commands for users using command-sets

Re: Cisco ISE Tacacs Policies Set

PutmanoAIT — Fri, 23 Mar 2018 02:47:26 GMT

Please kindly see the configuration as attach file.

Thank for your kindly support.

Re: Cisco ISE Tacacs Policies Set

Francesco Molino — Fri, 23 Mar 2018 23:47:15 GMT

How do you connect on the switch?

Your command authentication enable should be:
aaa authentication enable default group tacacs+ enable

On ISE, your user should have the password set on enable field.
When you're logged in, you need to type enable 7 and type your password. If you try enable, by default it will be enable 15 and you shouldn't be able to log in