AAA Privileges

I am setting up cisco ACS Server for 100s of network devices.

GROUPS DEFINED ============== Group 0 : Superuser(member usersname is a and n) Group 1 : admincentral(member usersname is d) Group 2 : adminsouth(member username is south) Group 3 : adminnorth(member username is north Group 4 : support(member username is support) Group 5 : viewer(member username is viewer) Group 6 : planning(member username is planning) Group 7 : planningconfig(member username is ?)

Network device groups NDGs Defined ================================== north centralnoncoreswitch centralnoncorerouter centralwireless centralcore south centraledge

AAA CONFIG IN CLIENT =================== aaa new-model aaa authentication login default group tacacs+ local enable aaa authentication login CONSOLE none aaa authentication enable default enable aaa authorization exec default group tacacs+ aaa accounting exec default start-stop group tacacs+ aaa accounting commands 15 default stop-only group tacacs+ tacacs-server host a.b.c.d tacacs-server directed-request tacacs-server key xyz

ACHIVEMENT SO FAR ================= Whenver I login to the device, it directly takes me into the privilige level e.g. level 15 for superuser for example instead of asking for enable password.

PROBLEM ======= How can I use effectively the "ENABLE OPTIONS", it has three options

1)No enable privileges 2) Max privilege level for any AAA client 3) Define MAX Privilege on a per NDG basis

But pitty is I am not able to use it effectively, can you help me ???

currently what I do is , I goto "TACACS+ SETTINGS" section and then CHECK the Shell(exec) and Privilege leve check box with number lets say 15 or 10 or 4.

believe me nothing works unless I check the PRIVILIGE LEVEL CHECK BOX and fill the number, whatever level I set there, it becomes applicable for all the users for all the devices and that is very strange can you help me ?

2ndly I can I do for a particular group that the members of the group can have view privileges for certain devices or NDGs while at the same time have FULL ACCESS to few particular devices, is it possible, how ?

I would be really obliged on your help

thanks and regards cheema

================================================================

Our activity has been completed. Specific users have been assigned certain groups which are being assigned to an NDG which is further assigned to SHELL COMMAND AUTH sets. Result is that we are able to manage many ADMINS with varying levels of privileges.

Following is the command set used in the AAA client.

aaa authentication login default group tacacs+ line enable aaa authentication login CONSOLE none aaa authentication enable default group tacacs+ enable line aaa authorization config-commands aaa authorization exec default if-authenticated aaa authorization commands 14 default group tacacs+ if-authenticated none aaa authorization commands 15 default group tacacs+ if-authenticated none aaa accounting exec default start-stop group tacacs+ aaa accounting commands 15 default stop-only group tacacs+

Kindly point out if you see any issues with this configuration

Thanks and Best Regards Cheema ==============================================================================