Hello all,
I have setup an ACS 5.1 system and a Cisco 3560 as test device. On the ACS system I have defined a user that will have limited access to Cisco CLI commands (privilege 15 through Shell Profile and limited commands through Command Sets). While this is working great for commands run under enable mode (meaning that the authorization denied the commands that I've specified in the Command Sets), it seems that it's not working under configure mode (e.g. I have denied commands like "router ospf" , "router bgp" , but the user can still apply them).
Before I've search this forum and found 2 posts:
https://supportforums.cisco.com/thread/2041611
https://supportforums.cisco.com/message/3057298
that suggest to have the AAA configured with:
aaa authorization config-commands
I already have this command and it still doesn't work. Actually my entire AAA config looks like this:
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
Did I miss something? Do you have any suggestion for me?
Thank you!
Calin
