topic Re: Looking for example authorization command sets for mid-privilege users in Network Access Control

Looking for example authorization command sets for mid-privilege users

CommKeeper — Sun, 23 Feb 2020 13:26:08 GMT

We recently started moving our devices back to TACACS authentication from RADIUS. We had this on ACS, but when we migrated to ISE it only supported RADIUS at the time. Now that we can do authorization sets again, I am curious as to what command sets you consider safe for Contractors or Junior Admins. I know this can vary by platform, but just looking for some ideas as we look to lock down these users command sets.

Re: Looking for example authorization command sets for mid-privilege users

Sheraz.Salim — Sun, 23 Feb 2020 13:34:44 GMT

There are plenty of resource on cisco website here

Re: Looking for example authorization command sets for mid-privilege users

CommKeeper — Sun, 23 Feb 2020 13:48:19 GMT

Thanks for sharing this link. I do understand how to set this up, but I'm just looking for some command sets others have used for roles such as these. I did not see that type of examples in the document link outside of 'show'.

Example:

Junior Admin

Permitted

#show

(config)# hostname

(config-if)# switchport

(config-if)# authentication

(config-if)# dot1x

(config-if)# service-policy

Denied

(config)# ip route

(config)# interface vlan

(config)# aaa

...etc.etc..

Re: Looking for example authorization command sets for mid-privilege users

Sheraz.Salim — Sun, 23 Feb 2020 13:54:39 GMT

check this page it has all the required information might be helpful for you here

Re: Looking for example authorization command sets for mid-privilege users

Greg Gibbs — Sun, 23 Feb 2020 22:18:33 GMT

TACACS+ Command Sets should be based on specific business requirements, so they are rarely "one size fits all"

You can find some examples in the following video, but you'll need to use the same methodology to develop your required Command Sets. You would typically want to test these extensively in a non-Prod environment as well before deploying into Production.

ISE 2.0: TACACS+ Command Authorization