I want to allow tty access for users and restrict them to only certain enabled commands (sh ip route, ip route, sh run, etc) - I poured through the online documentation and examples of RADIUS vs. TACACS and feel like I am missing one major point. Which AAA scheme do I *have* to use to accomplish this? Cisco's site said that both types will work, I have read on boards that only TACACS will work - (most config examples show RADIUS is more for PPP authentication)
I have freeRADIUS running and had no problems setting it up for authentication and accounting. It's setting the authorization levels that I dont get. I can get as far as allowing a user to log in as exec mode or enabled (with full rights) but not enabled and limited to certain commands. Is it possible? I also have the tac+ port on my Unix box but wanted to stick with radius if possible. I know we were able to set up our ATM switches using radius and dictionary files. Is that an option for the routers? thx - I'm stumped.
