topic ACS 4.1 setup in Network Security

ACS 4.1 setup

prashantrecon — Tue, 12 Mar 2019 02:20:00 GMT

Hi All,

1> Created two NT groups in window

VPNusers

Networkusers

2>created two group in acs such as

Routernetworkadmin

switch networkadmin.

3> Mapped vpnusers with routernetworkadmin

mapped networkusres with switchnetworkadmin

4> Created two NDG

Coredevices

L2devices

In coredevices add aaa client such as router,firewall, swith

in l2 devices added only switch

5) Created two NAR

superadmin

subadmin

under superadmin added NDG coredevices

under subadmin added NDG L2devices.

6> finally created two user say x and Y

user x is addedd under the group routeradmin group

user y is added under the group switch networkadmin

Requiremt is user x should access only devices mentioned under routeradmin group

and user y should access only devices mentioned under switch networkadmin group.

Does the above config works

ACS 4.1 setup

Amjad Abdullah — Tue, 06 Aug 2013 09:02:51 GMT

Hi,

If the NAR is configured correctly under the correct group, the above scenario should work.

From under the user group you need to select the NAR which decides what devices this group members can access.

HTH

Amjad

Rating useful replies is more useful than saying "Thank you"

ACS 4.1 setup

prashantrecon — Tue, 06 Aug 2013 09:54:36 GMT

Thanks

Will update once done with config

ACS 4.1 setup

prashantrecon — Sun, 11 Aug 2013 12:37:47 GMT

Hi Amjad ,

The above mentioned config is working.

Now i need to subadmin Nar to view only following command

Such as show ip route,

show ip interface briief,

show version.

Can u guide me .

ACS 4.1 setup

Amjad Abdullah — Mon, 12 Aug 2013 22:23:16 GMT

This is a different story.

To restrict commands you need to define command authorization sets.

This config example can be useful about how to define command authorization sets on ACS 4.x

http://tiny.cc/3q5p1w

HTH

Amjad

ACS 4.1 setup

prashantrecon — Tue, 13 Aug 2013 10:46:25 GMT

Thanks for doc.

Can u just provide some additional links

ACS 4.1 setup

prashantrecon — Tue, 13 Aug 2013 13:34:43 GMT

Hi Amjad

Below are the steps I have configured.

When i excute the command show version

I am geeting an error command authorization failed.Please help

Created a user in ACS such as super

Shared Profile Components
Create Shell command Autorization Set - "ReadOnly"
- Unmatched Commands - Deny
- Unchecked - Permit Unmatched Arg
- Commands Added
  - interface
  - ip
  - vlan
  - version
Created a group - "Admin" with the following
Confirgured - Network Access Restrictions (NAR)
Max Sessions - Unlimited
Enable Options - No Enable Privilege
TACACS+ Settings
- Shell (exec)
- Priviledge level is check with 1 as the assigned level
- Shell Command Authorization Set
  - "ReadOnly" - Assign a Shell Command Authorization Set for any network device

I have configured following on my Router/Switch
- aaa authorization config-commands
- aaa authorization commands 1 default group tacacs+ if-authenticated
- aaa authorization commands 15 default group tacacs+ if-authenticated

ACS 4.1 setup

prashantrecon — Mon, 19 Aug 2013 14:26:04 GMT

Hi Amjad,

Waiting for your suggestions.