4-4
User Guide for Cisco Secure Access Control System 5.4
OL-26225-01
Chapter4 Common Scenarios Usin g ACS
Overview of Device Administration
Step5 Configure an access service policy. See Access Service Policy Creation, page10-4.
Step6 Configure a service selection policy. See Service Selection Policy Creation, page10-4.
Step7 Configure an authorization policy (rule table). See Configuring a Session Au thorization Policy for
Network Access, page 10-30.
Command Authorization
This topic describes the flow for an administrator to issue a command to a network device.
Note The device administration command flow is available for the TACACS+ protocol only.
1. An administrator issues a command to a network device.
2. The network device sends an access request to ACS.
3. ACS optionally uses an identity store (external Lightweight Directory Access Protocol [LDAP],
Active Directory, RADIUS Identity Server, or internal ACS identity store) to retrieve user attributes
which are included in policy processing.
4. The response indicates whether the administrator is authorized to issue the command.
To configure a command authorization policy (device administration rule table) to allow an
administrator to issue commands to a network device:
Step1 Configure the TACACS+ protocol global settings and user authentication option. See Configuring
TACACS+ Settings, page18-1.
Step2 Configure network resources. See Network Devices and AAA Clients, page 7-5.
Step3 Configure the users and identity stores. See Managing Internal Identity Stores, page 8-4 or Managing
External Identity Stores, page8-22.
Step4 Configure command sets according to your needs. See Creating, Duplicating, and Editing Command
Sets for Device Administration, page 9-29.
Step5 Configure an access service policy. See Access Service Policy Creation, page10-4.
Step6 Configure a service selection policy. See Service Selection Policy Creation, page10-4.
Step7 Configure an authorization policy (rule table). See Configuring Shell/Command Authorization Policies
for Device Administration, page 10-35.
Related Topics
•Network Devices and AAA Clients, page 7-5
•Configuring System Administrators and Accounts, page 16-3
•Managing Users and Identity Stores, page8-1
•Managing External Identity Stores, page 8-22
•Managing Policy Conditions, page 9-1
•Managing Access Policies, page 10-1