topic Re: ISE command set not working as expected in Network Security

ISE command set not working as expected

mohanconnects — Sat, 07 Mar 2020 06:51:21 GMT

Hello,

I trying out ISE device administration, wanted to restrict for a user to send command 'username', so below is how I set TACACS+ profile and command sets.

TACACS+ profile

priv-lvl=4

command set

But when I tried to login, command username successfully get passed. Am I configuring it wrong, please guide.

Below username command actually sent without AAA error.

nexus88# config t
Enter configuration commands, one per line. End with CNTL/Z.

nexus88(config)# username ISE
warning: password for user:ISE not set. S/he may not be able to login
user steve does not have domain access to config Mo, class aaaUser

nexus88(config)# do sh ip int brief
Error: AAA authorization failed AAA_AUTHOR_STATUS_METHOD=16(0x10)

nexus88(config)#

Thanks,

Mohan

Re: ISE command set not working as expected

Cristian Matei — Sat, 07 Mar 2020 14:51:00 GMT

Hi,

You gave not too much info to help out. Check that both Nexus and ISE are configured properly first. Look here, in the Nexus section:

https://community.cisco.com/t5/security-documents/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365#toc-hId-1977002717

Regards,

Cristian Matei.

Re: ISE command set not working as expected

mohanconnects — Sat, 13 Jun 2020 13:22:27 GMT

Thanks Cristian Matei

Re: ISE command set not working as expected

Marius Gunnerud — Sat, 13 Jun 2020 14:00:35 GMT

As Christian has mentioned you have not provided enough information on the issue you are facing. Check the TACACS live logs to see what policy and command set is being used.