Exclude specific user from aaa authorization commands

diondohmen — Mon, 11 Mar 2019 05:25:48 GMT

Hi there,

I am trying to find a solution to exclude specific users from being authorized (AAA command authorization) when entering commands on the switch/router.

We use an AAA setup with Cisco ACS. On the devices we use:

aaa authorization config-commands
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 5 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local

is it possible, to exclude an user, say User1, from being command authorized?

In other words, when User1 logs on the switch/router, the switch/router shouldn't check the ACS if User1 is authorized to use this command.

We tried this with method lists in combination with ACL's on the VTY's:

line VTY 0

access-class 1 in

line VTY 1

access-class 2 in

Let's say, User1 always logs in from a specific IP, which is mentioned in access-list 2, the switch would use the method mentioned within the line vty 1.

But apparently, when a remote connection is being established, the switch/router uses the first VTY which is available, instead of watching which ACL can be matched to the source IP from the User.

Does anyone have some tips/tricks how to handle this?

Maybe a custom attribute from the ACS?

Kind Regards

Where does the user you are

nspasov — Tue, 10 Feb 2015 02:23:39 GMT

Where does the user you are trying to block reside? Locally on the device, AD or in the ACS database?

Thank you for rating helpful posts!

We have a RADIUS backend

diondohmen — Tue, 10 Feb 2015 07:45:24 GMT

We have a RADIUS backend where the user resides

If that user belongs to a

nspasov — Tue, 10 Feb 2015 18:49:26 GMT

If that user belongs to a unique group then you can write a policy where "if the user is in group x then return "access_reject" Or return "access_accept" but set the privilege level to "1" and block all commands.

Thank you for rating helpful posts!

topic If that user belongs to a in Network Access Control

Exclude specific user from aaa authorization commands

Where does the user you are

We have a RADIUS backend

If that user belongs to a