
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-07-2012 05:22 AM - edited 03-10-2019 06:48 PM
Hi Guys,
I'm working on an eval on vmware. I have got everything working for wlan authentication and I’m working on shell authentication for switches. On the ACS you have the possibility to give the user privilege level on the switch. You can do this with shell profiles in ACS.
Is there a way to get this done in ISE? I was thinking to make a result policy elements but I can't find a shell profile or privilege attributes like in ACS.
For the record, switch authentication is working with Active Directory. I only need to know how to give the right return attribute.
I appreciate any help!
Sander
Solved! Go to Solution.
- Labels:
-
AAA
Accepted Solutions

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-05-2021 03:42 PM
If you're defining privilege level 7 and providing the necessary commands on the switch, you can then provide the admin with privilege level 7 by returning a Shell Profile with the Default privilege level 7.
See the Cisco ISE Device Administration Prescriptive Deployment Guide for more details.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-27-2012 08:25 PM
ISE (as of now) doesnt support TACACS+ ; hence you will not be able to do shell profiles/priv. commands.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-12-2012 12:40 PM
@Sander,
You were in the right area.
Policy->Results->Authorization->Authorization Profiles.
Create AuthZ profile for Access-Accept and Under the Advanced Attributes Settings you can use:
Cisco:cisco-av-pair = shell:priv-lvl=15
or whatever privilege level you want to assign.
On your AuthZ rule, match the conditions and apply the created profile.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-31-2014 04:48 AM
I've tested this recently:
Using Cisco ISE as a generic RADIUS server
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-05-2021 05:48 AM
Hello, thank you for your response. What if you need to provide privilege level 7 with full running configuration view -> like this
privilege exec level 7 show running-config view full
Is there any option how could I set the atributes in ISE to do this?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-05-2021 03:42 PM
If you're defining privilege level 7 and providing the necessary commands on the switch, you can then provide the admin with privilege level 7 by returning a Shell Profile with the Default privilege level 7.
See the Cisco ISE Device Administration Prescriptive Deployment Guide for more details.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-05-2021 05:47 AM
Hello, thank you for your response. What if you need to provide privilege level 7 with full running configuration view -> like this
privilege exec level 7 show running-config view full
Is there any option how could I set the atributes in ISE to do this?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-05-2021 06:38 AM
You really should use TACACS+ for this...
