Cisco Systems CSACS3415K9 Policies and Network Device Groups, Example of a Rule-Based Policy

3-18

User Guide for Cisco Secure Access Control System 5.4

OL-26225-01

Chapter3 ACS 5.x Policy Model

Policies and Network Device Groups

Related Topics

•Managing Users and Identity Stores, page8-1

•Policy Terminology, page3-3

•Types of Policies, page3-5

Example of a Rule-Based Policy

The following example illustrates how you can use policy elements to create policy rules.

A company divides its network into two regions, East and West, with network operations engineers a t

each site. They want to create an access policy that allows engineers:

•Full access to the network devices in their region.

•Read-only access to devices outside their region.

You can use the ACS 5.4 policy model to:

•Define East and West network device groups, and map network devices to the appropriate group.

��Define East and West identity groups, and map users (network engineers) to the appropriate group.

•Define Full Access and Read Only authorization profiles.

•Define Rules that allow each identity group full access or read-only access, depending on the

network device group location.

Previously, you had to create two user groups, one for each location of engineers, each with separate

definitions for permissions, and so on. This definition would not provide the same amount of flexibility

and granularity as in the rule-based model.