This is assuming that ACS has already been configured for authentication via Active Directory
Creating a Shell Profile
>> Policy Elements >> Authorization and Permissions >> Device Administration >> Shell Profile
- Click on Create
- Under General Tab
- Enter name and Description
- Under Common Tasks Tab
- Default Priviledge = Static, Value = 15
- Maximum Priviledge = Static, Value = 15
- Submit
Creating a Command Set – Command Permissions
>> Policy Elements >> Authorization and Permissions >> Device Administration >> Command Sets
- Click on Create
- Enter Name and Description
- List command users in this group can use or check option to permit all commands except whats listed below
- Click Submit
Creating Access Service
You may use the two default Access service but these instructions covers adding a new Access Service
>> Access Policy >> Access Services
- Click on Create
- Enter Name and and Description
- Select a built in template or based off of an existing service
- If not, Select Service type – Device Administration
- Check Identity
- Check Authorization
- Click Next
- Check Process Host Lookup
- Check “Allow PAP/ASCII
- Click Finish
Enabling Service created above
>> Access Policy >> Access Services >> Service Selection Rules
- Click on create
- Enter Name
- Status = Enable
- Check Protocol = Match
- Click on Select, Choose TACACS and Click OK
- Under Result > Service, select the above Service created
- Click OK
- Save Changes
- Service Should be green
Note: I normally delete all default Access Services and create my own.
Associating an Identity for this Service
>> Access Policy >> Access Services >> Service Selection Rules >> Service >> Identity
- Choose “Single result Selection”
- Change Identity Source to AD1
- Save Changes
>> Access Policy >> Access Services >> Service Selection Rules >> Service >> Authorization
- Click on Customize – Lower right
- I normally add The following Conditions and Results
- AD1:External Groups
- NDG:Device Type
- NDG:Location
- Shell Profile
- Command Sets
- Click OK
- Save Changes
- Click on Create – Lower Left
- Enter name
- Check AD1:ExternalGroups and select AD group
- Check NDG:Device Type and select the types of devices this group can access
- Check NDG:Location and select the location this group can manage
- If they are not checked, they will not be affected. Idealy you can leave ALL
- Select Shell Profile
- Select Command Set
- Click on OK
- Save Changes
Equipment/Devices added as a AAA Client should be able to be managed by members of this AD group