prevent excecuting commands

[vos123]

We have a tacacs+ 3.2 server running on windows.

What do i need to prevent users excecuting commands like 'reload' and 'sh ip route' on the enable level.

and commands in the config mode ('no ip router bgp').

I'm looking for examples of configs on the router.

But most of all, how do I configure the tacacs+ server.

Greetings

Jeroen

[cdwyer]

You will need to create a Shell Command Authorization Set. That is located Shared Profile Components/ Shell Command Authorization Sets. After you create a Shell Command Authorization Set, you need to apply it to the group that the user is a member of. On the router, you need to make sure it checks with the ACS server for every command entered. That is done with the command:

aaa authorization commands 15 default group tacacs+ none