Command authorisation set on SecureACS

[kkeen]

Guys, I'm hoping you can assist. I've defined a group for some level 2 engineers within ACS, however I want to be able to grant access for these guys to 'create' sub interfaces and have full control over those, but I do not want them to have control over the Physical interface (ie, disable shutdown and encapsulation commands as to not bring down the sub interfaces)

Does anyone have a idea how this can be achieved?

I added a deny interface e0/0

then added permit interface, however this did not work

Ideas?

Thanks in advance!

[b.hsu]

I think this cannot be achieved using command authorisation, you need to have physical control over the boxes for this.

[kkeen]

Damn - does anyone else have any input? I'd really like to achieve this if possible

[472189]

Do you have config command autorization configured on the device??

[kkeen]

Indeed I do because I am using ACS to control access to various commands - its just I want to extend this control to limit physical interfaces only, not logical