Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Command Sets not working on ACS 5.1

I'm running ACS 5-1-0-44-3.

I have everything running properly on ACS 5.1.  I'd like to implement command sets for selected users and groups.  Under Access Policies -> Device Admin-> Authorization I have Command Sets selected.  The cisco provided is DenyAllCommands.  I have this command set running on all groups and every groups is still able to issue any command they wish.  I've also created a "show_only" command set that I've issued one group and they are still able to do conf t or any other command.

Am I missing something?

Do you need to reference the command set name under the shell profiles?

Its my understanding that all you have to do is reference it in "Authorization" in the rules under Device Admin.

I can understand a custom command set not working because of user error but DenyAllCommands should work.

Anyone have any ideas?

I have already re-patched the ACS

Stopped and started services.

And it seems like Command Sets is the only not referenced in the logs

1 ACCEPTED SOLUTION

Accepted Solutions
Community Member

Re: Command Sets not working on ACS 5.1

paste AAA config from your router and check in aaa tacacs+ authorization whether commands are verified and so on.

regards

5 REPLIES
Community Member

Re: Command Sets not working on ACS 5.1

paste AAA config from your router and check in aaa tacacs+ authorization whether commands are verified and so on.

regards

Community Member

Re: Command Sets not working on ACS 5.1

I am able now to deny/permit certain commands like show, conf t, etc.  Basically any command following #.  I'm now having a problem denying command after conf t.  I want to allow access to the fastethernet interfaces but deny serial interfaces.

If I DENY "interface" under the Command column it doesn't work.  I can still access all interfaces.

Community Member

Re: Command Sets not working on ACS 5.1

Got it working.

I was missing the "aaa authorization config-commands" command on the router.

Thanks for yout help

Community Member

Re: Command Sets not working on ACS 5.1

I do it a lot 

could you paste screnshot of your command set?

I've recently met another issue,

with my command set definition as below (as you can see its very simple):

almost every show is blocked (as suspected) but not "show run" (which is strange for me)

Community Member

Re: Command Sets not working on ACS 5.1

I've got it working like a charm now.  I'm not sure if you saw my previous post.  I was missing the command "aaa authorization config-commands" on my routers.

1894
Views
0
Helpful
5
Replies
CreatePlease to create content