This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC!
We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
Hello,
I have a problem with the ACS 5.2 configuration: I am trying to use the AAA authorization to centralize privileges and commands but only the privilege level is sent to router, the command set aren't sent.
The test cenary is this:
The ACS is configured with:
Shell Profiles (to match with a privilege level), Command Sets (with the command list), Service Selection Rules (to set to one service) and Authorization (to assign one shell profile and one command set).
The router is configured with the follows commands:
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization config-commands
aaa authorization exec default group tacacs+
aaa authorization commands 5 default group tacacs+
aaa authorization commands 10 default group tacacs+
aaa authorization configuration default group tacacs+
aaa session-id common
tacacs-server host xxxxxxxxxxx
tacacs-server key xxxxxxxxxxx
Troubleshoot:
Can anyone help me please?
Sorry for my english,
Thanks,
Solved! Go to Solution.
No I don't think it can be automatically loaded from ACS.
Instead of giving users priv level 5, you can give priv level 15 then you don't have to configure privilege commands on the router, because all commands are available to priv level 15 at the router. So you only need to configure commands set on ACS.
zhenning
If you assign user priv level 5, you should add allowed commands to priv level 5 at the router using the 'privilege' commands. If the command is not permitted for priv level 5 at the router, the router will not ask ACS for command authorization.
Pls rate the post if it is helpful.
Zhenning
Ok. I did understand, but is there any way of automaticaly load this from ACS?
Thanks,
No I don't think it can be automatically loaded from ACS.
Instead of giving users priv level 5, you can give priv level 15 then you don't have to configure privilege commands on the router, because all commands are available to priv level 15 at the router. So you only need to configure commands set on ACS.
zhenning
Thank you. I liked the idea and will do so.