Hi All,
I am trying to understand AAA concept and its use along with CSACS using TACACS+ protocol.
As far as I understand, by default there are 3 different privilege levels available (Ref: http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a008009465c.shtml)
* privilege level 1 = non-privileged (prompt is router>), the default level for logging in
* privilege level 15 = privileged (prompt is router#), the level after going into enable mode
* privilege level 0 = seldom used, but includes 5 commands: disable, enable, exit, help, and logout
According to the above URL, it is possible to change the default privilege level of any command and can be either decreased or increased to any privilege level between 2 to 14. Till this point, I understood it fine.
In a scenario where several administrators used to maintain Routers, I would like to grant different administrators with different level of privileges, so that they are allowed to execute only certain commands of that particular privilege level. It is prefered to use CSACS appliance for AAA authorization.
As I understand it is possible to grant administrators different privilege levels using CSACS by configuring shell privilege levels.
After an administrator is successfully authenticated, corresponding privilege level access is granted. Since by default privilege levels 2-14 doesnot contain any commands (hope I got it right!!!), even though the administrator is granted access to a privilege level between 2-14, he would not be able to execute any command unless a command is added to particular privilege level (either by decreasing or increasing from default privilege level).
I hope above descriptions are right, if not, please help me to understand this concept. It would be a great help if any one can redirect to a useful URL with detailed explanation about this topic.
Thank you,
Nagabhushan
