Hello,
I am having an authorization issue with ACS 3.2.3.
This is what I am trying to do: I have 2 Network Device Groups, one called core the other called edge. I have 2 groups of admins. One is Core admins and other is LAN admins. What I am trying to do is set up authorization so that the LAN admins can telnet into into the edge switches that belong to the edge Network Device Group. They will have the enable password for those devices so they can do whatever they need to do.
However, if they telnet into a core device I want the authorization to stop them so that they can't even connect to the device.
So my Lan admins will get full access to edge devices, but zero access to core devices. This is what I am trying to accomplish.
The closest I have come is allowing the LAN people to telnet or ssh to a core device, but not giving the enable password. So they have "read only" access to core devices. I don't even want this. How can I configure ACS to give me this behavior? I already have my aaa config in my network device configs.
