Radius AAA authentication for only group of users

[jazzzz]

Hi,

I'm using ACS3.1 and trying to use radius authentication for all the network switches in my company.

The problem im encountering now is how to restrict only a group of user to have login/exec access to the switches ? It seems that all the user ids in my acs able to telnet (user access) to the switch (using their login credentials).

I would like to restrict all even from telnetting using their ids except administrator group.

Any advise on how this can be achieved.

Tks !!

[gfullage · Accepted solution]

On ACS you'll have to put the admin users into their own separate ACS group, leaving the other users in their own group also.

Modify the group containing the users you don't want to give access to, and under the Network Access Restriction (NAR) section, in "Per Group Defined Network Access Restrictions", check the "Define IP based access restrictions", choose "Denied calling point" and enter the switches in the table below (put an * in for Port and Address).

This will disallow all your standard users from authenticating to the switches. You can add all your switches into a Network Device Group (NDG) so that then you only have to add that into the NAR section rather than add each switch in individually.

[jazzzz]

Great it works.. Tks for your help.. !!