cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1137
Views
10
Helpful
4
Replies
Beginner

Configuring ACS 5.x for Restricted Dev Admin Command Set

Hi every one there,

I am not new to ACS business, but this is the first time I am about to configure ACS 5.3 to authorize user group from doing some commands in the "configure mode" while permitting them some other commands. As example, I want to deny them from doing "reload" but give them access to configure "time-range", what happen is, they are denied access to "reload" on the exec mode, but once they went into "configure" mode, they would be able to "do reload"

I mean to say, is it possible to manage the subsequent commands to "configure terminal" ?

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

Configuring ACS 5.x for Restricted Dev Admin Command Set

Mike,

If this is IOS then make sure we have this command added,

aaa authorization config-command

This will authorize all commands executed in config t mode.

Regards,

~JG


Do rate helpful posts

4 REPLIES 4

Configuring ACS 5.x for Restricted Dev Admin Command Set

Mike,

If this is IOS then make sure we have this command added,

aaa authorization config-command

This will authorize all commands executed in config t mode.

Regards,

~JG


Do rate helpful posts

Rising star

Re: Configuring ACS 5.x for Restricted Dev Admin Command Set

Thanks for this info :-) 5+

Thanks & Regards

Configuring ACS 5.x for Restricted Dev Admin Command Set

Mike,

Like Jagdeep replied above, if you use that command on the IOS device (switch or router) then once you are on privileged mode you'll have all commands permitted.

You have to configure the ACS however to restrict access to the reload command for users in the enable mode.

This example will help you if you don't have an idea about the configuration already:

http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc8514.shtml

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

Rating useful replies is more useful than saying "Thank you"
Beginner

Configuring ACS 5.x for Restricted Dev Admin Command Set

Thanks Jagdeep, yes I am applying the commands to an IOS device. I have added your magic aaa authorization config-command  to IOS device aaa policy and tested it, looks great. Thank you very much.