topic Re: Tacacs command set cisco ise in Network Access Control

Tacacs command set cisco ise

Ramzan — Mon, 13 Jun 2022 19:36:07 GMT

Dear genius.

i am trying to restrict shutdown command under fastethernet interfaces of switch but want to allow shutdown command under gig interfaces. How will i achieve this?

is this possible or not?

please tell me Grant, Command and arguments for my query.

Re: Tacacs command set cisco ise

MHM Cisco World — Mon, 13 Jun 2022 21:10:42 GMT

https://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/113590-acs5-tacacs-config.html

I am new in AAA but I read before that TACACS can do control the commend available for each user.
please see link.
hope this help you

Re: Tacacs command set cisco ise

Ramzan — Tue, 14 Jun 2022 05:47:30 GMT

Dear MHM,

i am not asking how to control AD user access using ISE. The link which you shared i know thag thing. My question was how to provide a user deny and permit access for doing shutdown at same time under different interfaces of switch.

please read my question again.

Re: Tacacs command set cisco ise

balaji.bandi — Tue, 14 Jun 2022 09:22:32 GMT

This is required more of testing tweaking of shell profile : @MHM Cisco World concept suggested was on ACS. but ISE side also work as same.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200208-Configure-ISE-2-0-IOS-TACACS-Authentic.html

Watch this video get more idea, how you can do shell authorisation customisation.

https://www.youtube.com/watch?v=DlzALGHZ0o4