Radius authentication allow some of AD accounts not all of them

[CSCO12780120]

Hi everyone,

Can I use Radius authentication but allow parts of AD accounts to login device?

Or only few of user can access privilege level 15?

Configuration :

aaa authentication login default group radius local
aaa authentication enable default none
aaa authorization exec default if-authenticated
aaa accounting exec default stop-only group radius

Looking forward to your response guys.

[Rahul Govindan · Accepted solution]

If you use ISE, your Authorization policy could be to allow users from a certain AD groups (say Admins) to access network devices. Even though it authenticates all users on AD, the Authorization can restrict users based on your requirements.

[Peter Koltl]

https://ltlnetworker.wordpress.com/2014/08/31/using-cisco-ise-as-a-generic-radius-server/

[jeremykolkosn]

Is there an updated document for configuring Radius with Microsoft Network Policy Server (NPS), which replaced ISE?

[Peter Koltl]

No, NPS has not replaced ISE. (-: