Use ISE to limit access to specific VRFs

[Nerd_Herd]

One of my clients would like to limit access of user to their specific VRFs. Since the VRFs span multiple devices its not possible to restrict by network access device, We're using TACACS so I tried to limit commands pertaining to other VRFs but all commands were blocked regardless of the argument given. Ex command = sh argument= ^vrf vrfname$ I used the ^$ symbols to get the start and stop of the string but it hit on every vrf. Any examples doing something would be appreciated.  

[MHM Cisco World]

If that So it will work' keep in mind dont select permit any command not list option.

Goodluck 

MHM

[MHM Cisco World]

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_ise_tacacs_device_admin.html

By the way did you check this guide 

It have nice table for command regex 

MHM

[Nerd_Herd]

That's one of the things we discovered is that regex does not seem to work.