I'm doing an eval of ACS 5.3 for a client and i'm trying to integrate one of the routers into it using TACACS+. I had the authentication working with an internal user. when i went back in and added the authorization parts though, now i'm locked down to the enable prompt and can't do anything...trying to make sense of the documentation on how to assign the command sets, etc. to my test user, but it doesn't make any sense (this is some of the lousier documentation i've seen for a while...).
Does anyone have any thoughts on what to do to get the command sets to work?
as a follow up...i'm looking at ACS now. The way i have it setup is using the default 'permit all' for the device authorizations, shell profile, command sets, etc. It should let whatever commands i run through. But, all i see on the router is 'command authorization failed'. I can't even reload the thing now...
Is there a document somewhere that goes through step-by-step?
To get in you can change the shared secret in ACS so that the router will go into local mode, or you can just change the ip address of the router so ACS doesnt respond. That will let you in the router using your local credentials.
The shell profile that you are using, did you configure any other attributes like RBAC for other devices like nexus or WLC, if so you may want to switch the operand of mandatory to optional and then try you test again.
If you want to export your configuration you can go from the cli and issue the "acs backup...." to get the backup of your config, you will need to setup a repository to export this to.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...