ACS 5.4 Is it possible to have admins for each device group?

[ulises.alonsocamaro]

Hi all

I'm reading through the documentation and I don't see where it is possible to create new admin roles. I want to create new admin roles that only have permissions over a specific set of devices (ie, based in location -- I rather would prefer an attribute called department).

I found that it is possible to assign roles dynamically but I don't see how to create new roles and if I can create the type of roles I've used in the example.

Any comment or advice will be more than appreciated

Many thanks!

         Ulises

[aqjaved]

The ACS administrator might choose to create multiple access services to allow clean separation and isolation for processing different kinds of access requests. ACS provides two default access services:

•                                                  Default Device Admin—Used for TACACS+ based access to device CLI

•   Default Network Access—Used for RADIUS-based access to network connectivity

You can use the access services as is, modify them, or delete them as needed. You can also create additional access services.

Please check the below for configuration:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/policy_mod.html#wp1083695

[ulises.alonsocamaro]

Many thanks for your reply Ageel!

I think I didn't explain properly. I want to create restricted administrators in the ACS itself, not in the TACACS+ clients...

Seems like the way for doing this would be to create a new admin role that can operate on a given set of devices but so far what I have seen is that it is not possible to create new admin roles...

is this right?

Regards

     Ulises