cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1818
Views
0
Helpful
2
Replies

Cisco Prime Infrastructure 1.3 - Creating custom TACACS+ Attributes / Shell Profile for ACS 5.3

robert.lian
Level 1
Level 1

Cisco Prime Infrastructure 1.3 - Creating custom TACACS+ Attributes / Shell Profile for ACS 5.3

As titled, currently under Admistration> Users, Roles & AAA > User Groups > Export Task List under Cisco PI 1.3

All the attributes is "=" which is mandatory

Anyway i can make this optional?

Reason being is because i want to use the same TACACS Username for Cisco PI 1.3, IOS and NX-OS devices. NX-OS devices requires shell profiles to be optional.

Thanks.

2 Replies 2

Rollin Kibbe
Cisco Employee
Cisco Employee

Hi Robert:

All are mandatory.  If there were any that were optional, they would have been listed as such.  Wish it was better news.

Jon Glennie
Level 1
Level 1

Robert-

If you create a separate service rule, you can have it fork TACACS authentication requests from that specific IP to a different Service identity and authorization process, where you can tell it to select a specific shell profile.  Then all you have to do is create a separate shell profile for managing Prime and have that one selected.  We do this with our UCS dvices, regular router/switch CLI logins, etc.

So for example:

UCS: TACACS request --> if match service selection rule "from UCS devices", go to UCS admin access policy -->  if match ucs admin identiy reqirements, give UCS admin shell profile

PI: TACACS request --> if match service selection rule "from PI devices", go to PI admin access policy -->  if match PI admin  identiy reqirements (which are same as UCS), give PI admin shell profile

Default: TACACS request --> if match tacacs protocol from our IP range, go to default device admin policy --> if match defaul identy requirements, give default admin shell profile

Review Cisco Networking for a $25 gift card