Filter
Top Products
4-4
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 4 Common Scenarios Using ACS
Overview of Device Administration
Step 5 Configure an access service policy. See Access Service Policy Creation, page 10-4.
Step 6 Configure a service selection policy. See Service Selection Policy Creation, page 10-4.
Step 7 Configure an authorization policy (rule table). See Configuring a Session Authorization Policy for
Network Access, page 10-29.
Command Authorization
This topic describes the flow for an administrator to issue a command to a network device.
Note The device administration command flow is available for the TACACS+ protocol only.
1. An administrator issues a command to a network device.
2. The network device sends an access request to ACS.
3. ACS optionally uses an identity store (external Lightweight Directory Access Protocol [LDAP],
Active Directory, RADIUS Identity Server, or internal ACS identity store) to retrieve user attributes
which are included in policy processing.
4. The response indicates whether the administrator is authorized to issue the command.
To configure a command authorization policy (device administration rule table) to allow an
administrator to issue commands to a network device:
Step 1 Configure the TACACS+ protocol global settings and user authentication option. See Configuring
TACACS+ Settings, page 18-1.
Step 2 Configure network resources. See Network Devices and AAA Clients, page 7-5.
Step 3 Configure the users and identity stores. See Managing Internal Identity Stores, page 8-4 or Managing
External Identity Stores, page 8-22.
Step 4 Configure command sets according to your needs. See Creating, Duplicating, and Editing Command
Sets for Device Administration, page 9-28.
Step 5 Configure an access service policy. See Access Service Policy Creation, page 10-4.
Step 6 Configure a service selection policy. See Service Selection Policy Creation, page 10-4.
Step 7 Configure an authorization policy (rule table). See Configuring Shell/Command Authorization Policies
for Device Administration, page 10-34.
Related Topics
• Network Devices and AAA Clients, page 7-5
• Configuring System Administrators and Accounts, page 16-3
• Managing Users and Identity Stores, page 8-1
• Managing External Identity Stores, page 8-22
• Managing Policy Conditions, page 9-1
• Managing Access Policies, page 10-1