within my Cmd Auth set I have denied configure and when I test I still am able to issue the configure cmd.

this is because you have only configured authorization for level 1 commands not level 15.

conf t is a level 15 command

add, aaa authorization commands 15 default....

Regards,

Prem

I'm work with vaughantk...

I added the command "aaa authorization commands 15 default group tacacs+ if-authenticated" and took out the "aaa authorization commands 1 default group tacacs+ if-authenticated"

It appears to be working correctly now, but...

Can we just have the "aaa authorization commands 15 default.." and then deny everything we don't want? Or do we need "aaa authorization commands 1 default.." and so on for each privilege level we have?

Thank you for the help!

-Andrew

all the major commands are at level 15 by default. So monitoring 15 should solve your purpose.

You can also refer to,

Building a Scalable TACACS+ Device Management Framework:

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a0080088893.shtml

Command authorization for other levels are only required, if you have manually moved some commands to different level, and want to them to be allowed by Tacacs server first before they are allowed to be executed.

Regards,

Prem

Prem,

That seemed to have done the trick.

Thank you

Please mark this thread as resolved, so that others can benefit from it.

Regards,

Prem

Thanks for all the help Prem...one last thing for this thread.

So we now have in our config...

Aaa new-model

Aaa authentication login default group tacacs+ local

Aaa authorization config-commands

Aaa authorization exec default group tacacs+ local

Aaa authorization commands 15 default group tacacs+ if-authenticated

After we add the 3rd and 5th line to the configuration, we are instantly denied almost all commands. I'm assuming because it is checking with tacacs everytime a command is sent, and the group we are currently in is not one of the new groups with a command authorization set. Is there something we can add so that the old(current) groups will still work if their command authorization sets are not created yet, or is this an all or nothing deal? We would like to be able to create command authorizations sets for one group at a time, and the old/current groups still work.

Thanks for the help!

-Andrew

Hi Andrew,

As you said that you do not want other groups to be affected. Then for the mean while what you can do is, on all groups under which you have users, whom you don?t want to get affected.

Go to Group Setup > Edit Settings > check "Per Group Command Authorization" and check "Permit" > Submit + Restart.

And once you have configured the commands set, that you want this group should be allowed, select the appropriate one.

This is the only option, because, as soon as you apply the above mentioned commands, as you said, level 15 commands gets verified against the ACS server for authorization.

Regards,

Prem

Thanks Prem! You have been a ton of help.

Do you have any suggestions for where to find information on doing the same thing(Command Set Authorization) for Juniper Routers using Tacacs or Radius?

Thanks again,

Andrew