Hi everyone, I'm trying to configure a shell commnds set such that all commands (including under conf t mode) will be allowed, except for administrative commands, such as write, copy, admin, format etc. It's been working for (most) priviliged mode commands (such as write and copy) but has been unsuccessful for any command under conf t mode. It's important in order to prevent the users from performing 'do write' and 'do copy run start' commands, for example. Here's the input of the shell command authorization set (Partial_access): Unmatched Commands: permit Command list: admin copy delete do format write Group settings (relevent): V - Shell (exec) V Privilege level - 15 Shell Command Authorization Set Assign a Shell Command Authorization Set for any network device - Partial_access (group's name) I'm using CiscoSecure ACS version 4.2 (0) Thanks, Lior ... View more

Hi all, I've been trying to connect several IOS-XR devices on our lab (ASR's, GSR's and CRS's) to our TACACS+ server (Cisco Secure ACS, release 4.2(0)). The goal is that the TACACS will manage user authentication and command authorization for all CLI, non-console login types (telnet and SSH). I use no HTTP server access to the devices and I'd like to keep the console login to local credentials. I've got many IOS devices connected to that TACACS with the following AAA-related configuration. I'd like to implement the same principles on the IOS-XR's, but since the command structure is different and I couldn't figure out how to do this using the manual, I require your expert help: aaa new-model ! ! aaa group server tacacs+ acs-servers-group server <TACACS-IP-ADDRESS> ! aaa authentication login default local aaa authentication login local_vty local aaa authentication login console local aaa authentication login acs group acs-servers-group local aaa authorization exec default group tacacs+ aaa authorization commands 15 acs_cmds group tacacs+ aaa authorization commands 15 local_cmds none ! ! ! ! ! aaa session-id common ! skipped... ! username ******** privilege 15 secret 5 ************************************* ! skipped... ! tacacs-server host <TACACS-IP-ADDRESS> key 7 *************** tacacs-server directed-request ! skipped... ! line con 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 exec-timeout 0 0 privilege level 15 authorization commands 15 acs_cmds login authentication acs transport preferred telnet transport input all line vty 5 15 exec-timeout 0 0 * Note: IOS-XR device run 4.1.2 and 4.2.0 versions Thanks a lot for all help you could provide Lior ... View more

Hi all, I have a setup in which I've got two routers (router A and router B) connected indirectly through several other routers and between these two routers theres a functioning GRE tunnel whose IP address on each side is based on the loopback address (10.11.21.5 and 10.11.21.6 respectively). In addition there's an MPLS-TE tunnel headed from router B to router A, also based on these loopback addresses. Point-to-Point OSPF is running between each of the routers and its adjacent core routers (see diagram below). All OSPF neighbors are up correctly, but the thing is that there's an OSPF adjacency over the GRE tunnel as well and I'm not sure how to get rid of it. Here's the diagram: Here is the output of show ip ospf neighbor from both routers: Router A: RouterA1#show ip ospf neighbor Neighbor ID     Pri   State           Dead Time   Address         Interface 10.11.21.6        0   FULL/  -        00:00:32    10.11.21.6      Tunnel501 10.11.21.4        0   FULL/  -        00:00:39    10.11.11.45     GigabitEthernet2/4 10.11.21.4        0   FULL/  -        00:00:39    10.11.11.41     GigabitEthernet2/3 10.11.21.3        0   FULL/  -        00:00:31    10.11.11.29     GigabitEthernet5/1/1 10.10.21.2        0   FULL/  -        00:00:38    10.11.11.25     GigabitEthernet5/1/0 RouterA# Router B: RouterB#show ip ospf neighbor Neighbor ID     Pri   State           Dead Time   Address         Interface 10.11.21.5        0   FULL/  -        00:00:39    10.11.21.5      Tunnel501 10.11.21.3        0   FULL/  -        00:00:34    10.11.11.37     GigabitEthernet6/0/1 10.11.21.1        0   FULL/  -        00:00:38    10.11.11.33     GigabitEthernet6/0/0 RouterB# Here are the GRE tunnel configurations, plus the loopback configurations on the two routers: Router A: interface Tunnel501 description ### GRE Tunnel to NPE-7609-RAN1 ### ip unnumbered Loopback0 no ip route-cache keepalive 60 5 tunnel source 10.11.11.26 tunnel destination 10.11.11.34 tunnel key 30 tunnel checksum end interface Loopback0 ip address 10.11.21.5 255.255.255.255 end Router B: interface Tunnel501 description ### GRE Tunnel to NPE-7606-RAN1 ### ip unnumbered Loopback0 no ip route-cache keepalive 60 5 tunnel source 10.11.11.34 tunnel destination 10.11.11.26 tunnel key 30 tunnel checksum end interface Loopback0 ip address 10.11.21.6 255.255.255.255 end Here's the show run | s router ospf section from both routers: Router A: RouterA#show run | s router ospf router ospf 65200 router-id 10.11.21.5 network 10.11.11.24 0.0.0.3 area 0 network 10.11.11.28 0.0.0.3 area 0 network 10.11.11.40 0.0.0.3 area 0 network 10.11.11.44 0.0.0.3 area 0 network 10.11.21.5 0.0.0.0 area 0 bfd all-interfaces mpls traffic-eng router-id Loopback0 mpls traffic-eng area 0 Router B: RouterB#show run | s router ospf router ospf 65200 router-id 10.11.21.6 network 10.11.11.32 0.0.0.3 area 0 network 10.11.11.36 0.0.0.3 area 0 network 10.11.21.6 0.0.0.0 area 0 bfd all-interfaces mpls traffic-eng router-id Loopback0 mpls traffic-eng area 0 If there are any other missing details, pleaes let me know. Thanks in advance, Lior ... View more