Cisco 2509 - Router - EN User Manual page 192

Configuration-specific User Group Settings
From the Jump To list at the top of the page, choose TACACS+.
Step 3
Result: The system displays the TACACS+ Settings table section.
Use the vertical scrollbar to scroll to the Shell Command Authorization Set
Step 4
feature area.
To prevent the application of any shell command authorization set, select (or
Step 5
accept the default of) the None option.
To assign a particular shell command authorization set to be effective on any
Step 6
configured network device, follow these steps:
a.
b.
To create associations that assign a particular shell command authorization set to
Step 7
be effective on a particular NDG, for each association, follow these steps:
a.
b.
Tip
c.
Step 8 To define the specific Cisco IOS commands and arguments to be permitted or
denied at the group level, follow these steps:
a.
b.
User Guide for Cisco Secure ACS for Windows Server
6-32
Select the Assign a Shell Command Authorization Set for any network
device option.
Then, from the list directly below that option, select the shell command
authorization set you want applied to this group.
Select the Assign a Shell Command Authorization Set on a per Network
Device Group Basis option.
Select a Device Group and a corresponding Command Set.
You can select a Command Set that will be effective for all Device
Groups, that are not otherwise assigned, by assigning that set to the
<default> Device Group.
Click Add Association.
Result: The associated NDG and shell command authorization set appear in
the table.
Select the Per Group Command Authorization option.
Under Unmatched Cisco IOS commands, select either Permit or Deny.
If you select Permit, users can issue all commands not specifically listed. If
you select Deny, users can issue only those commands listed.
Chapter 6 Setting Up and Managing User Groups
78-14696-01, Version 3.1