Read Only access to execute show crypto ipsec sa peer [IP]

[Jay Joshi]

Hello All,


I have created a privilege level 5 as read only access for a user. I want to enable show crypto ipsec sa peer [IP address]. Currently my statement is "privilege show level 5 mode exec command" however I am able to execute only "show crypto ipsec" and not the complete relevant command. Please advise what changes do I need to make inorder for complete command to work.

[Karsten Iwen]

Instead of using the legacy privileges, I would configure it with Role-Based Access Control (RBAC). With that you have much more control over what you want to allow.

[Jay Joshi]

Hello Karsten,

I am using a cisco ASA 5585X. Looks like Role Based Access Control commands are not support on my platform.

We generally use TACACS to manage users, however this device is not under TACACS and we had to go the old style.  Would appreciate if you could help me modify my existing command to execute show crypto ipsec sa peer [IP]

Best Regards,
Jay Joshi

[Jay Joshi]

Hello,

This issue is resolved. I did not enable command authorization on my firewall and hence had issues.

http://www.cisco.com/c/en/us/td/docs/security/asdm/6_2/user/guide/asdmconfig/mgt_acc.html#wp1581382

Regards,
Jay Joshi