topic CSM per admin group using per device group in Network Security

CSM per admin group using per device group

mallenson — Fri, 21 Feb 2020 12:21:23 GMT

I am looking to see if multiple admin and device groups can be created to limit certain administrators to administrate only certain devices but not others.

For example:

admin group "ag_na" (including user admin1 & admin2) can make changes to device group "dg_na" containing (device 1, device 2) only

admin group "ag_ca" (including user admin3 & admin4) can make changes to device group "dg_ca" containing (device30 & device31) only

Any tips on if / how to do this?

Thanks

Re: CSM per admin group using per device group

ROBERTO GIANA — Thu, 26 May 2011 14:52:22 GMT

You can do it by integrating the CSM into an ACS v4.2 and doing RBAC. There you can define for which NDGs a user has which access policy.

http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/installation/guide/aduser.html#wp1063220

Unfortunately this is a short-therm solution as ACS v4.2 has been put to EoS and no real alternative methods are available today. Hopefully Cisco will come up with a new solution on the long-therm.