topic Re: Permit specific commands with Tacacs Commands Set and Cisco IOS in Network Access Control

Permit specific commands with Tacacs Commands Set and Cisco IOS

drivera_ — Thu, 18 Feb 2021 00:20:42 GMT

Hello, guys

Right now I'm trying to permit specific commands in a catalyst sw by configuring a Tacacs Commands Set on ISE. Everything is good when a users logs in and try to type any command in exec mode because I can see only the commands I configured in the command set are being permitted. The thing is that when a user goes to configuration mode (conf t is permitted too in tacacs commands set), she can type any command in configuration mode and not only the commands I defined in the command set. For instance, I didn't permit the vlan comand in the command set, but even that a user can type and use it. I read that I needed the command "aaa authorization config-commands" but even after applying this command, the behaviour still is the same. I don't know if I have to do any other thing, so I writing here looking for help. Thank you in advance.

Re: Permit specific commands with Tacacs Commands Set and Cisco IOS

balaji.bandi — Thu, 18 Feb 2021 00:50:00 GMT

i would revisit the config for the user and check each step, is there any higher level option given to the user :

check below guide example : (if the user got a different access level you can find in ISE Logs see what permission and what rule set or policy matching)

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200208-Configure-ISE-2-0-IOS-TACACS-Authentic.html#anc12

Re: Permit specific commands with Tacacs Commands Set and Cisco IOS

Rob Ingram — Thu, 18 Feb 2021 08:50:37 GMT

@drivera_

Sounds like it could be an authorization configuration issue, have you configured authorization commands on the switch as per the Device Administration prescriptive guide?

https://community.cisco.com/t5/security-documents/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365#toc-hId-759088769

Please provide the aaa configuration of your devices.

Re: Permit specific commands with Tacacs Commands Set and Cisco IOS

drivera_ — Mon, 22 Feb 2021 16:11:35 GMT

@Rob Ingram @balaji.bandi thank you so much for your helpk, guys. I deleted and reconfigured everything again and It worked, but this time I didn't use the default aaa list and instead of that I created different lists for authentication, authorization and accounting and applied them to the vty lines. I thought that when configuring the "aaa authorization config-commands" command and typing the tab key the command didn't complete itself but I realized IOS leaves the command to autcomplete itself and when trying to execute it, it shows the "command authorization failed" message. Thank you again.