Configuring ACS 5.x to authenticate Role Based Access Control (RBAC) users on a Nexus 5000 switch via TACACS

[slawford]

The following guide shows how to return a TACACS attribute in ACS 5 defining the role a user should be placed into on Nexus 5K switches that use Role Based Access Control (RBAC).

This guide makes the following assumptions:

• You are using the TACACS protocol to authenticate RBAC users on a Nexus 5000 switch.
• Your ACS service selection rules direct all TACACS requests to the "Default Device Admin" access service.
• The switch is aleady added as a network device in a network device group specifically for Nexus switches.
• Users are already mapped to an Identity Group on ACS that will then map to their role on Nexus.

Step 1:

Create an Authorization Policy rule to match the user and device criteria as shown below:

Step 2:

Create a Shell Profile to return the required attributes. In the following example the user will be placed into the "Network-Admin" role:

Step 3:

Map the Shell Profile to the Authorization Policy rule:

Step 4:

Log into the Nexus switch. To confirm that the rule has been successfully matched, check the hit count next to the rule. Note you may need to refresh the hit count status by clicking on the hit count button on the bottom right hand corner, and then refresh.

 

[bzeitner]

FYI - While using ACS 5.3, the attributes needed to be entered as:

Attribute: cisco-av-pair

Requirement: Optional

Value: shell:roles*"network-operator"

Note, you can assign multiple roles by adding a space between role names (i.e. shell:roles*"network-operator vdc-operator")

[smhaider2010]

Thanks for your reply.

aaa authentication login default group ACS

 But the above command is not type local (key word).How to authenticate with (Local Switch Database and ACS ) at a time. 

[OBINNA EMESORONYE]

Hello bzeitner,

In the event that you have multiple roles in the shell profile as you have done, how can we determine which user has access to Network admin and which user uses Network operator.

Thanks,