Tacacs problem with ACS 4.2 NDG and shell authorization sets

[uzbrdicanagib]

Hi all,

I am trying to solve this problem without success so far. I have fresh ACS 4.2.15 patch 5 ACS installation and I am tryng to deploy it to our environment. So I have configured one 2960S to be my test client and everything works fine. Problem is when I try to create fine grained policies using network device groups and shell authorization sets.

I have created shell authorization sets called ReadOnly and FullAccess. I have also created NDG called FloorSwitches and added my 2960. I have 2 user groups called FloorSwitchesReadOnly and FloorSwithcesFullAccess. Now, if I configure group FloorSwitchesFullAccess and assign Shell command authorization set per NDG and then log into the switch, all of my commands are refused as unauthorized.

One thing that I have noticed is that if I assign shell command authorization set to any device ( in user group settings ) it works fine. Or if I create association with DEFAULT NDG in user group it also works. So my conclusion is that ACS for some reason does not associate my switch with correct group but rather puts it to DEFAULT group for some reason.

Did anyone had similar problem or is there something that I am doing in a wrong way? Is there another way to achieve such thing without using NDG's?

Thanks everyone....

[Tarik Admani · Accepted solution]

Please upgrade to patch 6, there is a bug in patch 5 and you can check the release notes or the readme for more information.

What is your user setting set to while you are testing command authorization, did you set it back to the group setting?

Thanks,

Tarik Admani

[uzbrdicanagib]

Thank you for the help, I guess that is one of the reasons they removed patch 5 from the dowloads...