Configuring AAA on Cisco IOS

Configuring AAA on Cisco IOS

In this section we will see how to create the AAA function of below profile.

• Dclessons_Netadmin: Will have full control of the network device
• Dclessons-IOS_NetOps: Will have full control of the network device but are not permitted to erase the configuration.
• Dclessons_IOS_HelpDesk: Should be able to see the status of certain show

Create the Authorization Results for Network Administrators

Create the TACACS profile

Work Centers | Device Administration | Policy Elements | Results | TACACS Profiles | Click Add. | Name the profile

Leave the Common Task Type field at its default value, Shell and Check the Default Privilege check box and set the value to 15

Set the Maximum Privilege check box and set the value to 15

Se the idle time value to 5 Min

Click Submit.

Create the TACACS command set for network administrators

Work Centers | Device Administration | Policy Elements | Results | TACACS Command Sets | Click Add | Name the profile

Check the box for Permit Any Command That Is Not Listed Below.| Click Submit.

Create the Authorization Results for Network Operators

Create the TACACS profile

Work Centers | Device Administration | Policy Elements | Results |TACACS Profiles |Click Add | Name the profile 

Leave the Common Task Type field at its default value, Shell | Check the Default Privilege check box and set the value to 7.

Set the Maximum Privilege check box and set the value to 15 |Click Submit.

Create the TACACS command set for network operators

Work Centers | Device Administration |Policy Elements | Results |TACACS Command Sets | Click Add | Name the profile 

Set the Check the box for Permit Any Command That Is Not Listed Below.

In the Commands section, click Add | Set to DENY_ALWAYS the reload and shutdown commands

Create the Authorization Results for the Helpdesk

Create the TACACS profile

Work Centers | Device Administration | Policy Elements | Results |TACACS Profiles | Click Add.

Name the profile 

Leave the Common Task Type field at its default value, Shell| Set the Default Privilege check box and set the value to 2.

Set the Maximum Privilege check box and set the value to 2 |Click Submit.

Create the TACACS command set for the helpdesk users

Work Centers | Device Administration | Policy Elements | Results | TACACS Command Sets| Click Add | Name the profile