Assigning command to priv level

networker99 · ‎04-17-2009

TACACS is being used to provide access to the switches. We have set up an authorization set, but I want to know how to assign a specific command to an priv level. For instance we grant a vendor level 5 access, and want to assign the command "show interface" to priv level 5. Can this be set in TACACS or does it have to be on the switch itself?

Jagdeep Gambhir · ‎04-17-2009

Since you have tacacs then best option is to use command authorization.

Please see this link,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

Trick here is to give all user prov lvl 15 and then apply command autho set.

Having Priv lvl 15 does not mean that user will be able to issue all commands. User will only be able to issue commands that you have listed.

Regards,

~JG

Please rate helpful posts