ACS Tacacs+ aaa authorization commands

[p.tavan]

Hi,

I would like to authorize only certain configuration commands by the Tacacs Server, so in the group setup of ACS, I have checked : command, I have written in the field : configure, and declared as arguments : permit terminal and permit snmp-server enable traps. But I can not configure snmp until I declare in the router : privilege config level 7 snmp-server enable. (I use a level 7 user)

My question is : is there a way to control the granularity of configuration commands on the ACS, in the same way as you can control the granularity of the show commands ?

Many thanks

Patrice

[chandlerbr]

Yes, you can get very granular using Command Authorization Sets and they can be applied to individual users or groups.

Setting Up and Managing Shared Profile Components

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a00800d9e6b.html

hth

[p.tavan]

I thank you a lot for your answer that I am going to try.

Patrice