Evaluation of the authorization policy straight after authentication?

[mykys]

Hi guys,

I feel like it's a noob question but my understanding always was that there should be a separate TACACS+ authorization request which is not blended into an Authentication packet:

Please can you educate me, and point me to the correct KB?

Thanks,

myky

[Mohammed al Baqari · Accepted solution]

Hi,

You are right. NAD sends two seperate requests for authen and author. ISE
evaluate authorization profile part of policy set to put the user in the
right shell (priv). Further command authorization is sent in seperate
requests and evaluated against authorization policies if any.

Hope this helps.

***** please remember to rate useful posts

[mykys]

Hello,

Thanks for your reply, and I think I got it now. 

So basically, you will have to have shell access in the first place when authenticated, and for that to be allowed, you will have to have an explicit Authorization policy (which gets evaluated during the auth).

Then commands authorization, as you mention, (if configured) where another user group and authorization policy lookup happens and is logged by ISE as the separate Authorization lookup log.

Is my understanding correct?

Thanks,

myky 

[Marcelo Morais]

Hi @mykys ,

 for better understand, please take a look at: Cisco ISE Device Administration Prescriptive Deployment Guide.

Hope this helps !!!

[Mohammed al Baqari]

Yes that is correct.

**** please remember to rate useful posts