ACS, how to prevent web users access to firewall CLI?

[andrea.meconi]

Hello.

I'm using a PIX with software version 6.3(5) wih the cut-through proxy feature. PIX queries a TACACS+ to authenticate web users.

I need a filter, NAR on ACS, to allow web users access Internet from a specific subnet only.

Actually, same web users credentials allow access to firewall CLI from different subnet!

Any idea?

Thanks.

Andrea

[andrea.meconi]

With a NAR filter based on IP addresses, I can confine access from a specific subnet only.

Regards.

Andrea