ISE/Radius & Network Device Read Only

[jhaddix385]

We use our ISE server as a Radius/TACACS for our network devices.  Does ISE (if so how) could you configure users on ISE to only have read-only (show commands) on network devices registered to ISE

[paul · Accepted solution]

You have to use TACACS to do this efficiently.  You would configure the device for TACACS command authorization (in addition to authentication and accounting).

aaa authorization commands 15 default group ISE-TACACS if-authenticated

There is not need to authorize anything but level 15 commands.  You should account for level 0, 1 and 15 though in the accounting setup:

aaa accounting commands 0 default stop-only group ISE-TACACS

aaa accounting commands 1 default stop-only group ISE-TACACS

aaa accounting commands 15 default stop-only group ISE-TACACS

Depending on your switch the TACACS syntax will be different.  Once you have command authorization enabled you would configure a command set in ISE that allows "show" command.  All other level 15 commands will be denied.  Tie that to your desired TACACS rule for the group of users you want to have read-only access.  Setup a TACACS profile that assigned priv level 15 and max priv level 15 to the users as well.

[BrianPersaud]

Is there a way to do this with radius?  I don't have tacacs licenses on ISE.

[Jason Kunst]

as he said not too efficiently, would recommend tacacs, we don't recommend radius as its very limited therefore don't spend much time on it
some thread discussions
https://www.google.com/search?q=ise+radius+device+administration&oq=ise+radius+device+&aqs=chrome.0.0j69i57j0j69i60j69i64.2540j0j7&sourceid=chrome&ie=UTF-8
https://community.cisco.com/t5/policy-and-access/device-administration-using-radius-cisco-ise-2-3/td-p/3309882