To all those eagerly awaiting the answer to this question:
This step by step guide assumes that you are using an external identity store or not requiring your internal users to have a separate enable password, and that these have already been configured. Acs is laid out in a way that guides you through the configuration if you know what you are doing. In any implementation you should configure acs in this way: add in your devices (network resources) add your users (users and identity store) configure policy conditions (policy elements) and finally configure your policies (Access Policies).
Step 1.
| Policy Elements > | Authorization and Permissions > | Device Administration > | Shell Profiles |
click the check box for the permit access shell profile then click duplicate.
In the General tab name the profile whatever you want, I chose enable. In the Common Tasks tab change the drop down menu to static and value to 15 for both Default Privilge and maximun Privilge. Hit Submit
Step 2
| Policy Elements > | Authorization and Permissions > | Device Administration > | Command Sets |
Hit create.
I named my command set AllowAllCommands
Step 3.
| Access Policies > | Access Services > | Default Device Admin > | Authorization |
in the lower right-hand corner of the screen click customize.
Make sure the customize conditions and result contain Shell Profile, command sets and AD:external groups (see the image below). This allows you to control under which conditions you authenticate users. Click ok
Now we need to create a rule to match authentication request against. under the same page now click create in the lower left hand corner.
Now you are almost done.
The only thing that needs to be updated on the device config is the AAA/tacacs and vty line config.
here's what i use
aaa authentication login default group tacacs+ line
aaa authentication login no_tacacs none
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ local < - drops uers into enable
aaa authorization commands 0 default group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
tacacs-server host 10.125.1.4
tacacs-server host 192.168.36.4 <- High availability backup acs
tacacs-server directed-request
tacacs-sefver key 7 xxxxxxxxxxxxxxx
line vty 0 15
login authentication default
username user1 privilge 15 secret sUp3rs3cr3t < fallback local authentication
