topic Re: Enable authentication only through ISE in Network Access Control

Enable authentication only through ISE

katerina.dardoufa — Wed, 13 May 2020 10:19:27 GMT

Hi all,

I have this situation where I need to authenticate a particular user on Nexus devices via ISE, but the user should not be permitted to do anything else on the device.

I have configured a new Tacacs Profile with the following:

Common Task Type -> Nexus

Set Attribute as: Optional

Network Role --> None

VDC Role --> None

Custom Attribures

Mandatory priv-lvl:0

Mandatory max_priv_lvl:0

I also created a TACACS Command Set that denies any configure and any show commands.

In the Policy Sets for the explicit user, when trying to access the Nexus Devices, the authorization policy is tied with the above command sets and the profile.

The end result is what I am expecting... user can log in and nothing can be run. Is this the correct way to go about it or do I need to do something different. To be frank I got a bit confused with the Profile settings...

Thank you in advance,

Katerina

Re: Enable authentication only through ISE

Arne Bier — Wed, 13 May 2020 10:35:57 GMT

That looks pretty good to me. So in effect, this is like a TCP keep alive for Nexus to check whether TACACS+ server is still alive?

Why is this feature so important? If you have two TACACS+ servers defined in your config Group, then surely that would suffice? If a request to server 1 times out after 3 attempts, then use server 2, etc.

The keepalive feature might make things happen a bit faster/deterministic - but if it causes your auditors to have a coronary, then you could probably leave it out.

Re: Enable authentication only through ISE

poongarg — Wed, 13 May 2020 10:56:02 GMT

Command authorization via Tacacs is allowed on the Nexus but Command authorization disables user role based authorization control (RBAC), including the default roles. As you are configuring command set, I believe below config is there on your Nexus switch:

—aaa authorization commands default <ISE>

—aaa authorization config-commands default <ISE>

In such case, this config, looks good to me, although I don't see the need for custom attributes.

Re: Enable authentication only through ISE

Sheeneattigrm3 — Thu, 14 May 2020 11:28:32 GMT

TelltheBell wrote:
Command authorization via Tacacs is allowed on the Nexus but Command authorization disables user role based authorization control (RBAC), including the default roles. As you are configuring command set, I believe below config is there on your Nexus switch:
—aaa authorization commands default <ISE>
—aaa authorization config-commands default <ISE>

In such case, this config, looks good to me, although I don't see the need for custom attributes.

Thank you for sharing article and information. this is very helpful for beginner.

Re: Enable authentication only through ISE

katerina.dardoufa — Wed, 13 May 2020 11:47:57 GMT

Hi Arne,

this is indeed a sort of keepalive for the Nexus... If the auditors don't like it, and aren't satisfied with our explanations, then we will live it out. If we can keep it though and it works, even better!

Re: Enable authentication only through ISE

katerina.dardoufa — Wed, 13 May 2020 11:52:26 GMT

So I understand that I could remove the priv-level etc altogether and everything would still be ok, since I am limiting access through the command sets.