Stopping router telnet access with ACS 3.1

[john.pierson]

Hi folks,

I was running ACS2.6 & using TACACS+ to authenticate dial in users & access to routers. When dial up users tried to telnet to a router they received an authorisation failure (EXEC box not ticked) if they tried to log in. Since upgrading to ACS3.1 they now log in & get a command line. They cannot get into enable mode however I don't like the fact they can actually get onto the routers.

Anyone know how I can stop this?

Thanks in advance, John.

[benhur.p]

But I guess as long as they cannot get into enable mode it is ok right?

[john.pierson]

I would rather they cannot get onto the router at all. Even in non-priveledged mode you can gain quite a bit of information about the router & telnet to other devices.