ACS and AAA Help

[jonchill]

I've just configured ACS and TACACS+ for access to our switches using our AD for authentication. It works fine.

What I would like to know is firstly how can I configure ACS to only allow access to our switches if you belong in a particular AD group or ACS group as at the moment anyone can login to our switches if they are a user on the domain?

Secondly is there a way within TACACS+ to audit every single command that is entered while someone is loggin into a switch?

Any help would be much appreciated.

Thanks

Jon

[a.kiprawih]

Hi Jon,

1. Refers to the previous post at:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddb89cb/0#selected_message

2.The audit feature that you're looking at is available for valid command once the user/admin entered 'conf t' command.

The following command can be used to monitor what commands are being entered by the user/admin:

aaa accounting network SAMPLE start-stop group tacacs+

You can see the report under ACS's "Logs and Reports" section - look for tacacs+.

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7aa.html#wp1005522

*can also look under sample config.

Rgds,

AK