Restrict Single Interface ACS 5.4

[deanlee10]

Hello,

I am running ACS 5.4.0.46.4.  I am creating command sets to restrict access for a certain group of users.  Is there any way to restrict them from accessing a specific interface (Gi1/1/1 for instance)?  I tried putting a "deny interface GigabitEthernet1/1/1" into the command set rules, but I am still able to access that interface?

[Jatin Katyal]

Please post the screen shot of command set that you have created on ACS under policy elements.

From the end network device, get the following o/p

-debug tacacs

-debug aaa authen

-debug aaa author

-show run | in aaa

From  ACS 5.4 > monitoring and logging > tacacs authorization > find the user failed attempt > clcik on the magnifying glass in front of it and attach the screen shot of that page.

~BR
Jatin Katyal

**Do rate helpful posts**

[deanlee10]

Actually I figured it out.  I left out the space between the interface type (Gi) and number (1/1/1) in the argument.

[Jatin Katyal]

Alright, that's a good news.

Here is a link to configure command authorization on ACS 5. You may want to bookmark it.

http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc8514.shtml#ade

~BR
Jatin Katyal

**Do rate helpful posts**