This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC!
We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
We recently started moving our devices back to TACACS authentication from RADIUS. We had this on ACS, but when we migrated to ISE it only supported RADIUS at the time. Now that we can do authorization sets again, I am curious as to what command sets you consider safe for Contractors or Junior Admins. I know this can vary by platform, but just looking for some ideas as we look to lock down these users command sets.
There are plenty of resource on cisco website here
Thanks for sharing this link. I do understand how to set this up, but I'm just looking for some command sets others have used for roles such as these. I did not see that type of examples in the document link outside of 'show'.
Example:
Junior Admin
Permitted
#show
(config)# hostname
(config-if)# switchport
(config-if)# authentication
(config-if)# dot1x
(config-if)# service-policy
Denied
(config)# ip route
(config)# interface vlan
(config)# aaa
...etc.etc..
check this page it has all the required information might be helpful for you here
TACACS+ Command Sets should be based on specific business requirements, so they are rarely "one size fits all"
You can find some examples in the following video, but you'll need to use the same methodology to develop your required Command Sets. You would typically want to test these extensively in a non-Prod environment as well before deploying into Production.