cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Register for SecureX webinars to learn about our newest integrations and features.


812
Views
15
Helpful
2
Replies
Highlighted
Beginner

Help with TACACS+ Command Sets in ISE 2.6

I am hoping someone can help me with a new ISE 2.6 implementation.  We have TACACS+ device management working very well but now we have been asked to give very limited switch CLI access to some helpdesk staff.  Basically they should be able to do any 'show' commands and then only change VLANs on switch interfaces.

I created a new "User Identity Group" called Network-Helpdesk and added a new test user to this group.

I then created a new "TACACS Command Set" called "HelpDeskCommands" and a new "TACACS Profile" called "Helpdesk Shell Profile". 

Finally, I modified our "Device Admin Policy Set" to include a new "Authorization Policy" using the newly created "HelpDeskCommands" and "Helpdesk Shell Profile".

I was able to get the new test user authenticated with limited access and only able to do 'show' commands. I even tested denying certain 'show' commands and this worked for my test user as well.

At this point, I tested that this user couldn't do any configuration as I was getting "Command authorization failed." when trying to enter 'conf t'.

So I added "configure terminal" to the command set and after doing so it it lets the user in to configuration mode but doesn't seem to limit them in any way as to what they are able to configure.  I also didn't see any authorization messages for the individual commands showing up in the ISE logs.

I'd like to allow these users to enter in to configuration mode but then only be able to configure gigabitethernet interfaces.  Additionally, only certain commands within interface configuration mode.  But again, once they do 'conf t' ISE seems to authorize them to do all commands.  What am I missing?

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Collaborator

Hi,

 

   You have not configured your NAD to ask for authorization of config commands. Not sure what your NAD is, but for IOS and IOS-XE, the command would be "aaa authorization config-commands".

 

Regards,

Cristian Matei.

View solution in original post

2 REPLIES 2
Highlighted
Collaborator

Hi,

 

   You have not configured your NAD to ask for authorization of config commands. Not sure what your NAD is, but for IOS and IOS-XE, the command would be "aaa authorization config-commands".

 

Regards,

Cristian Matei.

View solution in original post

Highlighted

Thank you Cristian!  That was it.  I was so focused on all the changes within ISE, I was forgetting to check the existing config on the switches.  Adding 'aaa authorization configs-commands' immediately fixed my problem and I have been able to create a very limited command set.  It is also logging all config changes as expected.  Thanks again Cristian.

Content for Community-Ad
Additional Cisco Threat Response Resources


August's Community Spotlight Awards