RE: Best practices for implementing Cisco ACS?

["Proulx, Mark J" <mark.j.proulx () lmco com>]

Adrian, 
There are a couple of things that you can do.

1.  Create a group and give it Priv 15.  Then grant the specific
commands that you wish that group to have and end the list with a deny
all, similar to an ACL (if you add a new command, be sure to delete and
add back the deny rule at the end).  Then assign user(s) to the group
that you wish to have that type of access to the device.  I've found
that to be the most effective way to control what commands a group can
have without having to apply priv level commands on each device.

2.  If you wish to control what devices that a group can access, that
becomes a bit more challenging.  If you are using a UNIX version of ACS,
and you have a well defined structure for your dns naming of devices or
a good plan for IP addressing for the area you wish to grant access, you
can use regexp to filter on the host name/IP address.  This works very
well to keep users out of devices you do not wish them to have access.
For example, 

        The dns naming structure for a network I worked on was
        
                st-city-[street]-device
                wa-seattle-sw
                il-chicago-112th-gw

Based on that structure, I could create a regexp that would look at the
st (state) and device and grant access and commands for that type of
device.  You could also use the IP address range if you  submitted based
on an area that you wished to grant access for the remote admins.  The
great thing about this is that when a user authenticates to a device, if
they are not allowed on the device, the telnet session is terminated and
the user is booted off the router.

If your doing this on a Windows version of ACS, I believe that IP
addressing is the only way to control a groups access to a device...

I hope that helps, I'm sure there are other ideas also...

Mark J. Proulx
System Engineering Senior Staff
Lockheed Martin Technical Resource Center
303-971-4625
mark.j.proulx () lmco com
mjproulx () skytel com




-----Original Message-----
From: Adrian DuPre [mailto:adrian.dupre () zimmer com] 
Sent: Wednesday, October 20, 2004 1:29 PM
To: security-basics () securityfocus com
Subject: Best practices for implementing Cisco ACS?


Has anyone successfully (or not-so-successfully) implemented Cisco ACS 
for granular control of router access?  We're looking to define access 
levels for local/remote IT staff based on job function.  What 
tips/tricks/resources/best practices did you find?  (Aside from the 
"Fine Manual")

Thanks in advance,
-Adrian