Good Morning,
not sure if this is the right commnunity....anyway....
We are looking for a possibility to allow our User Helpdesk to modify access-lists on our Cisco ASA based client VPN. I'm wondering if it is possible to add a local user to the ASA who is allowed to enter configuration mode but can only execute commands like 'access-list ...'.
I already managed to set the privilege level so that the user can enter configuration mode and only see the access-list command but unfortunately he is not allowed to execute the command.
Any hint is appreciated.
Thank you.
------
asa-tst-rts# sh access-list
access-list Default; 10 elements; name hash: 0x2b24c7de
access-list Default line 1 remark ???
access-list Default line 2 standard permit host ???? (hitcnt=0) 0xe63fe3f9
access-list Default line 3 remark ???
access-list Default line 4 standard permit host ??? (hitcnt=0) 0x2f379ee1
[...]
asa-tst-rts# conf t
asa-tst-rts(config)# ?
access-list Configure an access control element
clear Clear
configure Configure using various methods
end Exit from configure mode
exit Exit from config mode
logout Logoff from config mode
no Negate a command or set its defaults
quit Exit from config mode
asa-tst-rts(config)# access-list ?
configure mode commands/options:
WORD < 241 char Access list identifier
asa-tst-rts(config)# access-list Default ?
ERROR: % Unrecognized command
asa-tst-rts(config)# access-list Default
ERROR: % Incomplete command
asa-tst-rts(config)#
