AAA Global config granularity

[keyonj]

It seems as though, when running Cisco IOS/ACS on Win2K, you can only lock a individual down to user exec, prvi exec, but once they are allowed into global configuration they can access everything. The question is, does acs allow you to only allow certain commands in glabal config, such as allowing setting vlans but disallowing changing routing protocol configurations? It seems to be all or nothing.

Thanks for any advice.

[sstudsdahl]

You can use ACS to restrict the commands that are allowed. Take a look at the link below for "Command Authorization Sets".

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/c.htm#wp697557

HTH

Steve