Authorization Question2

[cannonscott]

I have a small group of users that I want to allow access to a switch. I only want to allow them to do "show int status", "show run" and "show proc." What is the best way to set this up? Does the privlige level have to be set up on the switch or is this done on the ACS. The users are set up in a group called "UserSupport"

[nchopra79]

Hi,

Try this:

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a008009465c.shtml

Regards.

[cannonscott]

That shows how to set up basic Authorization on the switch but dosen't help with setting privlige levels or command authorization.

[Kevin Dorrell]

The top of the document tells you about the basic setup, but the example shows you how to set the privelege levels required to use certain router commands (in this case, level 7), and shows you how to set up the TACACS so that specific users have level 7 access (as opposed to the more normal level 1 or 15), so they can use those specific commands. You need to dig quite deep into the example, but the information is there.

But if you want a more detailed document, here is one:

http://www.cisco.com/en/US/products/sw/secursw/ps4911/products_tech_note09186a0080107cfd.shtml

Here is a document that tells you how to do it without a TACACS:

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml

Kevin Dorrell

Luxembourg