cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

430
Views
5
Helpful
4
Replies
Highlighted
Beginner

Looking for example authorization command sets for mid-privilege users

We recently started moving our devices back to TACACS authentication from RADIUS. We had this on ACS, but when we migrated to ISE it only supported RADIUS at the time. Now that we can do authorization sets again, I am curious as to what command sets you consider safe for Contractors or Junior Admins. I know this can vary by platform, but just looking for some ideas as we look to lock down these users command sets.

4 REPLIES 4
Highlighted
VIP Advocate

There are plenty of resource on cisco website here 

please do not forget to rate.
Highlighted

Thanks for sharing this link. I do understand how to set this up, but I'm just looking for some command sets others have used for roles such as these. I did not see that type of examples in the document link outside of 'show'.

 

Example:

Junior Admin

Permitted

#show

(config)# hostname

(config-if)# switchport

(config-if)# authentication

(config-if)# dot1x

(config-if)# service-policy

Denied

(config)# ip route

(config)# interface vlan

(config)# aaa

 

...etc.etc..

 

Highlighted

check this page it has all the required information might be helpful for you here 

please do not forget to rate.
Highlighted

TACACS+ Command Sets should be based on specific business requirements, so they are rarely "one size fits all"

 

You can find some examples in the following video, but you'll need to use the same methodology to develop your required Command Sets. You would typically want to test these extensively in a non-Prod environment as well before deploying into Production.

ISE 2.0: TACACS+ Command Authorization