In Command Authorization want to Block some specific command of Config mode through ISE

[gurbinder.kabbay]

Hi Experts,

I want to restrict few commands on Router/ Switch in config mode. means for some specific group. I want they can do normal config , but will not be able to change other sensitive config like enable password, line vty, aaa etc.

I tried it though by TACACS command set in ISE , but when i tried to run the blocked command on device in Configure terminal, its working, which i do not want. it seems after entering into config mode this TACACS  command set is not working for this particular group. 

Moreover, I blocked enable mode command i.e reload there, its blocked, but I am unable to block some specific configure terminal commands.

kindly help me to achieve this.

Regards,

Gurbinder

[rschlayer · Accepted solution]

Hello @gurbinder.kabbay ,

you should be able to deny the commands in the tacacs command set.

Make sure you configure the router/switch with the corresponding aaa authorization commands. I believe you must have the following configured as well:

aaa authorization config-commands

 My config looks like this (we push priv via ISE too):

aaa authorization config-commands
aaa authorization exec default group ISE local
aaa authorization commands 0 default group ISE local
aaa authorization commands 1 default group ISE local
aaa authorization commands 15 default group ISE local

Best regards,

Rick

[gurbinder.kabbay]

Thanks Rschlayer for reply.

I will apply this solution, lets see if this will fix.

Regards,

Gurbinder

[gurbinder.kabbay · Accepted solution]

Thanks Rick.

Its working now.

Thanks very much..

Regards,

Gurbinder