Hi everyone,
I've migrated ACS from 4.2 to 5.8.
For Cisco IOS devices I've had to add the default privilege attribute in order to authenticate via TACACS. For JUNOS I've had to use the custom local-user-name attribute to do so (the local-user-name had a list of allowed commands within the JUNOS configuration). These two worked fine together in ACS 4.2 where each user group had service shell (exec) and service junos-exec.
However, under ACS 5.8 I can't mix these two attributes, and service junos-exec is nowhere to be seen. I'm unsure if I need service junos-exec, but I didn't have to give command sets different treatments for Cisco and Juniper devices in ACS 4.2. I get the feeling that something is missing from ACS 5.8 in this regard.
The solution I've tried out so far is migrating from 4.2 to 5.8, adding device types for cisco and juniper in 5.8, exporting the network devices from 5.8, importing them back with the correct device types after manually updating the devices file. After this I can create an authorization policy which picks the shell profile according to device type. This works fine, but it doubles the amount of authorization policies.
Could this have been done differently so that I can send the attributes for both junos and cisco without causing authentication failures, or any other solution which involves less dirty work?
Thanks!
