I'm trying to configure our switches to authenticate commands against our 4.2 ACS server. The ACS server is already up and running and we are able to authenticate against it correctly. What im trying to do is setup shell command authorization sets within the ACS server to allow different groups to perform different commands. They are working as desired when users are in either regular or enable modes. However once they go into config mode all bets are off. It really seems like the switch is following its own rules.
In the shell set, all i have configured is to permit "config terminal" and nothing else. However when you go into config mode you can perform many different config commands. Including changing port configurations. However you cant do everything, for example you cant change aaa authroization commands. It errors out saying command is not authorized. So i know there is a command set applied somewhere. To add to the confusion, in ACS when i change it to allow all unmatched commands, then i can use authorization commands in config mode. Why would this shell command set allow interface config changes but block others even though there is nothing set to allow or block those commands?
This is what i have configured on the switches:
aaa authentication login default group tacacs+ local aaa authentication login NOTACACS local aaa authentication enable default group tacacs+ enable aaa authorization config-commands aaa authorization exec default group tacacs+ if-authenticated aaa authorization commands 1 default group tacacs+ if-authenticated aaa authorization commands 15 default group tacacs+ if-authenticated aaa accounting commands 1 default stop-only group tacacs+ aaa accounting commands 15 default stop-only group tacacs+ aaa accounting connection default start-stop group tacacs+ aaa accounting system default stop-only group tacacs+
In the last year, we’ve seen substantial changes in how enterprises conduct business. When the pandemic hit, it exposed gaps in business continuity plans, and it showcased the need to quickly deploy and remotely manage secure connections.
On 18th December 2020, Cisco announced the latest IOS XE release - Cisco IOS XE Bengaluru 17.4.1a
The first one in the Cisco IOS XE Bengaluru release series, IOS XE 17.4.1a unlocks various routing features and enhancements comprehensively c...
Exploring business options for a SD-WAN managed serviceLogicalis UK offers a rapid, cost effective deployment with ngenaAdvantages that make a differenceSummary of benefits:Looking forwardResources
This event had place on Tuesday 19th, January 2021 at 10...
(view in My Videos)
Community Live- May the SD-WAN Force Be With You
This event took place on Tuesday 19th, January 2021 at 10:00hrs PDT
In this session attendees received an introduction to Software Defined-WAN (SD-WAN) and the importance of ...
Cisco Champion Radio · S8|E3 The Cisco DNA Center Machine Reasoning Engine
Machine Reasoning is a new category of AI/ML that you will soon hear a lot about. It saves your IT team time by automating complex and tedious networking tasks. It can also...