How to set shell profiles and command sets to allow show run on ACS

[kay.kang]

Hi,

We want to allow some ReadOnly users to do show running command across network device but not allow them to still make any change configuration. It seems RO users can put some commands but they can't put show run command yet. Following snapshots are our setups regarding ReadOnly access policy on ACS. 

How can we make this work?

[Greg Gibbs]

No hardware/software versions specified, so assuming this is a duplicate post.

See https://community.cisco.com/t5/network-access-control/how-to-control-command-on-nexus-switch-with-acs-based-on-priv/td-p/4922419