How can i deny access with ACS

[alon to]

Hello,

I manage all my users with Tacacs CISCO ACS.

I have group that i allowed them to enter to "configure terminal" level. but i don't want that they have access to

"router isis \ router bgp \ router ospf" on "configure terminal".

I tried the following settings:

also i tried

and it's not work fine. what can i do to deny access to router (bgp \ isis \ ospf) settings ?

Thanks,

Alon

[Ravi Singh]

As per my knowledge configuration looks perfect. I would suggets to remove and reapply the same config.

[Saurav Lodh]

Please turn "# debug aaa authorization " and check the av pairs

[alon to]

Hello,           

Problem solved, had no command  --> "aaa authorization config-commands"

Thanks