topic You could use roles in NX OS in Network Access Control

ISE RADIUS authorization NX-OS

rodrigohcsilva — Mon, 11 Mar 2019 05:07:21 GMT

Anybody could confirm if RADIUS authorization is not supported on NX-OS?

If it's not supported, how should it be configured with ISE once ISE doesn't support TACACS?

NX-OS(config)# aaa authorization config-commands default group radius local
Radius group is not supported for command authorization
could not update aaa configuration

You could use roles in NX OS

jan.nielsen — Fri, 17 Oct 2014 22:54:05 GMT

You could use roles in NX OS instead to define what commands users can issue, and assign them using ISE via radius.

Jan is correct, you can't

nspasov — Sun, 19 Oct 2014 07:10:09 GMT

Jan is correct, you can't configure NX-OS based device the same way you would IOS based one when it comes to AAA. NX-OS devices do not "understand" privilege level. Instead, they use RBAC (Role Based Access Control). As a result, you have to return a shell role from your Radius server:

shell:roles=user_role

For more info take a look at the latest "NX-OS Security Configuration Guide" or this link:

http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6-x/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6-x_chapter_0110.html#task_1074483

Hope this helps!

Thank you for rating helpful posts!