This is what I would like to do for our Core Routers. Not too familiar with ACS, so please excuse me if I don't provide you will all the details.
Right now I have ACS 5.3 which is tide to Active Directory. When a user logs in they use there AD credentials to access the CLI and use that same password to access privileged exec mode.
What I want to do is have users log in using their AD credentials like normal but have a unique password to access privileged exec mode, different for each user.
So far this is what I have done:
1) Created a test user (same as AD user name) in the Internal Identity Store
Password Type: Internal Users
normal password set differently that Enable Password (I think Enable Password will only be relevant)
2) Created a rule under Access Policies > Device Admin - Commands > Identity
- Created Rule with Current Condition Set (TACACS+:Authen-Type match ASCII And (TACACS+:Action match Login AND TACACS+Service match Enable))
- Identity Source: Internal Users
When I enable the rule. I can login with my AD credentials, but when I try to access privilege exec mode the password that I created for the local user (regular and enable) does not work.
Question: Do I need to create a shell profile with Maximum privilege value set to something under 15 for the authorization policy and apply it so it will try and use the internal user's enable password?
Not to familiar with how this works. One of my co-workers said I needed to demote the users in order for my rule to work.
