cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1051
Views
5
Helpful
4
Replies

Looking for example authorization command sets for mid-privilege users

CommKeeper
Level 1
Level 1

We recently started moving our devices back to TACACS authentication from RADIUS. We had this on ACS, but when we migrated to ISE it only supported RADIUS at the time. Now that we can do authorization sets again, I am curious as to what command sets you consider safe for Contractors or Junior Admins. I know this can vary by platform, but just looking for some ideas as we look to lock down these users command sets.

4 Replies 4

There are plenty of resource on cisco website here 

please do not forget to rate.

Thanks for sharing this link. I do understand how to set this up, but I'm just looking for some command sets others have used for roles such as these. I did not see that type of examples in the document link outside of 'show'.

 

Example:

Junior Admin

Permitted

#show

(config)# hostname

(config-if)# switchport

(config-if)# authentication

(config-if)# dot1x

(config-if)# service-policy

Denied

(config)# ip route

(config)# interface vlan

(config)# aaa

 

...etc.etc..

 

check this page it has all the required information might be helpful for you here 

please do not forget to rate.

TACACS+ Command Sets should be based on specific business requirements, so they are rarely "one size fits all"

 

You can find some examples in the following video, but you'll need to use the same methodology to develop your required Command Sets. You would typically want to test these extensively in a non-Prod environment as well before deploying into Production.

ISE 2.0: TACACS+ Command Authorization 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: