Hi,
I have an existing ACS4.2 installation that I am migrating to a V5.5 appliance.
So far I have managed to configure the basics within V5.5, but I need to understand how to apply different command sets to the same group of users that apply to different Network Device Groups (NDG).
I will explain further:
In the existing ACS 4.2 install, I have a group of users (designers) who have access "Full Access" (configure etc) to Cisco devices in a NDG for our test environment. I will call it the TEST NDG.
This same designer group has "Read Only" access to the remainder of the network (show commands but no configuration). For the explanation I will call the NDGs NET1, NET2 and NET3.
So within the ACS4.2 Group configuration for Designers, I apply the "Read Only" command authorisation set to NET1, NET2 and NET3 along with the "Full Access" command authorisation set to TEST.
This works well in our environment and I am now trying to map the same restrictions in V5.5, but so far with no luck.
Although I have managed to add 1 command set to the Identity group (which works well), I am unsure how to add a second command set that applies to a different Device group for the same Identity Group.
Has anybody any ideas how to achieve this?