Read Only access, for a single user, to ALL route/switch devices on large network

[Steve Coady]

Hello

I have been tasked with creating a RO access for a single user on ALL my network devices.

I have Cisco Secure ACS 5.3

I use TACACS. 

Where/how would I create the user RO account that would push this out to all network devices?

[Ivan Gonzalez]

Hi Steve,

Since this task needs to be accomplished for a specific user. You can do the following:

1-Create a command set for this specific user to allow/deny the required commands on the following section "Policy Elements > Authorization and Permissions > Device Administration > Command Sets."

2-Create a rule using username as condition as you can see on the bellow example to assign Read only command set as you can see on the example attached ( please make sure to move this rules at the very top of from the other rules you might have configured, as this is very specific).

Note: Please marked as answered if applicable