Yes, using Cisco ACS server. I'm stuck trying to find what links the different menu items to the users ability to make a menu selection / execute the command specification of that menu item (telnet to xxx.xxx.xxx.xxx device).

IE - how can I let group "admin" access all devices, while having a group "firewall" able to access all of firewall resources, while allowing both types of users to login to this particular router, but still preventing firewall from logging into any other router?

A brief example of the configuration options necessary to restrict this would be great.  Is my confusion clear / is what I'm asking clear?

Thank you for your assistance thus far!

Have a look here - http://www.cisco.com/en/US/products/sw/secursw/ps2086/prod_configuration_examples_list.html

See if thos helps out.

Thank you, I will look through these to see if I find something that details my confusion.

Hi

You can achive the same with ACS Server, Follow The below Steps.

1] In Network Configuration Tab Create Different Group for Router , Switches & Firewall.

2] Create Different User Group & Assign what need to be access (i.e. Network Configuration Group - Router Group , Swich Group & Firewall Group)

3] Create User and assign the User group that he want to access .

For Example : In Network Configuration Group : Create : Router , Switch , Firewall

                     In User Group : Create two Group : Group 1 & Group 2

                     Group 1 is associated with Router, Firewall , Switch Group.

                      Group 2 is associated with only Router & Switches.

                    Create Two User : User 1 & User 2

                    User 1 is associated with Group 1

                    User 2 is associated with Group 2

So User 1 can access all Router, Firewall , Switch & User 2 can access only Router & Switches

Regards

Chetan kumar

So esentially, what you're implying is that:

The 2811 that provides the terminal access through the HWIC-16A connections does not have any permissions management on board. However, I could use the ACS grouping and permissions system to require users to reauthenticate with the Cisco ACS server when they make a menu selection that ultimately redirects them to telnet to a device. They will then check permissions with the server when logging into that device, just as if they telnet to it from anywhere else?

I could then allow access to the 2811 but restrict what other commands they are able to execute in privileged mode?

I understand how Cisco ACS works - but I'm still not positive that I'm understanding how you imply I should associate it with my setup.

Remember - after connecting to the 2811, they make a selection to a menu item to connect via console to that device.

Thank you for the replies so far!