Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
dsc
New Member

Using NAR's to restict access to commands

I have the following aaa commands on my devices

aaa new-model

aaa authentication login default group tacacs+ line

aaa authorization exec default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

NOw I created a NAR to restrict (or permit) certain show commands. I have also created a separate grp. that has this NAR in it's settings.

But I notice that it does not stop any of the other commands (that I have specifically denied ) or even the unmatched arguments (box not checked)

So my question is, are my aaa commands on my device overriding these NAR's?

I tried it without the "if-authenticated" for the authorization lines but that did not help.

Any help will be greatly appreciated.

Thanks,

1 REPLY
Anonymous
N/A

Re: Using NAR's to restict access to commands

I think it is essential to configure if-authenticated command for proper working of TACACS.

111
Views
0
Helpful
1
Replies
CreatePlease to create content