Hi Expert

I am testing ISE 2.2 Device admin(TACACS+) with Nexus platform.

I want to apply command authorization based on sub command mode per account(identity).

below is example I want to do.

Goal Summary

• only restrict 'shutdown' command on interface config mode, not BGP config mode per account(identity).
• basically, If I define deny 'shutdown' command on command set, this command sets applied all command mode like interface, BGP etc. but I want to restrict this command only on interface sub command mode.

Example

• restrict 'shutdown' command on interface config mode
• permit 'shutdown' command on BGP config mode

NX-OS(config)# interface ethernet 1/1

NX-OS(config-if)# shutdown                         ==> restrict

NX-OS(config-if)# exit

NX-OS(config)# router bgp 65001

NX-OS(config-router)# shutdown                  ==> permit

NX-OS(config-router)# neighbor 1.1.1.1

NX-OS(config-router-neighbor)# shutdown   ==> permit

OR

• restrict 'shutdown' command on interface config mode, BGP process config mode
• permit 'shutdown' command on BGP neighbor config mode

NX-OS(config)# interface ethernet 1/1

NX-OS(config-if)# shutdown                         ==> restrict

NX-OS(config-if)# exit

NX-OS(config)# router bgp 65001

NX-OS(config-router)# shutdown                  ==> restrict

NX-OS(config-router)# neighbor 1.1.1.1

NX-OS(config-router-neighbor)# shutdown   ==> permit

Do you have any idea to do this ?

Regards,