Security

I am trying to set up ClearPass to be used for authentication on my Cisco ACE modules. I have configured the AAA on the Cisco device and I can log in. The ACE devices use role based access and it expects the server to send back a shell command to tell it what role the user is in. Within Cisco ACS that was easy. I am trying to find the same function in Clearpass.

 

Example from Cisco ACS server: shell:Admin*Admin default-domain

Create an enforcement profile and choose TACACS as the type. Then choose
shell from the service dropdown. Now can assign a privilege level.

Thanks. Unfortunately the Privilege level is not understood by the Cisco ACE modules.

 

As you can see from below, the users are assigned roles not privelege levels. The default if the ACE does not receive any feedback is Network Monitor.

 

ACE-Core1/Admin# show users
User Context Line Login Time (Location) Role Domain(s)
*admin Admin pts/45 Mar 13 08:34 (192.168.69.65) Admin default-domain
jnel Admin pts/46 Mar 13 09:24 (10.12.5.36) Network-Monitor default-domain
ACE-Core1/Admin#

Sorry missed that.

 

So it looks like each context needs its own attribute. You could try creating a custom TACACS+ dictionary with these levels, but I would work with TAC on this.

 

shell:<context-name-1>
<role name> <domain>

 

Thanks. I am working with TAC. Still no solution yet. If we do find one, I will post the results here.

Does not appear if TAC has any idea on how to resolve the issue. Anyone on here have any input? Surely someone out there has done this before.

My ACEs were recently retired so I haven't tested this, but try the following:

 

Name: insert name of context (admin,prod,etc)

Value: replace "role" with the ACE role, followed by "domain default-domain"

 

 

 

Thanks I will try that.

 

I have managed to make it work using Radius as well.

 

In your Enforcement provile

 

 you can use the following

 

 

 

Nice!  Thanks for posting that.