Cisco secure acs

[karl.jones]

Hi

If I have a TACACS server authenticating incoming ras sessions and I apply users to a group that only allows telnet access to 172.16.3.1 for example, if someone dials in, telnets to that Ip address, will they then once connected to 172.16.3.1:23 be able to telnet from that box to other boxes on the network.

Any thoughts here would be appreciated

Regards

[bstillman]

Yes, they will be able to telnet to other devices. If this box is a router, you can deny that user from executing the telnet command via ACS. However, if the box is a UNIX server, there is no way to stop that user from telnetting to other devices. If you put the box on an isolated segment, you could implement ACLs on your router and not allow that box to telnet to other devices on your network.