topic Re: users privilege in Cisco Router and ASA in Network Access Control

users privilege in Cisco Router and ASA

mohamed.ali — Fri, 21 Feb 2020 18:42:16 GMT

Dears,

please, I have junior network engineers I wanna to create to them read-only users in Cisco Router and ASA.
I wanna the standard command that I'll link it with users privilege.

like:

username blabla privilege 10 secret blabla

thanks,

Re: users privilege in Cisco Router and ASA

Karsten Iwen — Sat, 23 Dec 2017 12:11:37 GMT

For an easy read-only-access, just make sure that they get a user-mode-login, but don't provide the enable-password. The privilege-levels are only needed if your junior-admins also need commands that are only available in level 15.

The best way to control all this is from your TACACS-server.

Re: users privilege in Cisco Router and ASA

mohamed.ali — Sat, 23 Dec 2017 14:28:35 GMT

there are other choices?

as well for ASA ?

Re: users privilege in Cisco Router and ASA

Karsten Iwen — Sun, 24 Dec 2017 09:42:40 GMT

For sure there are many choices:

As mentioned, the most flexible and powerful ist the use of TACACS+. There is also a free server available: http://tacacs.net/download.asp
The privilege-levels are available on all platforms but need to be configured on all devices in a similar fashion. If you don't have a central configuration-management, this could become quite difficult.
On IOS, there is also RBAC. But that is not available on ASAs.