SecureACS - and LDAP

Question

I'm having problems understanding the concept of how ACS is supposed to work. Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box. However, anyone w/ a valid LDAP account can authenticate. How exactly do I narrow which LDAP users can authenticate? How do I make it so some users can access some devices, but not others?

Answer 1

The most common way is to segregate access based on group membership. Within ACS there is/should be an "Access Policies" menu - I won't go into every detail of configuring ACS here, because that's why there's a manual, but you can essentially define your policies of which groups members can log in (and which group members have access to run which commands) there. In addition, there's also a way to define hierarchy in your actual network devices themselves (via hostnames, "Locations", etc) that can provide further criteria on network device access. ACS is a decent product if you need point-and-click AAA, but there are far cheaper ways to do the same thing if you have staff that know what they're doing (see tac_plus or FreeRADIUS).

Taking some care in defining and laying out elements in your Network Resources/Network Device Groups in ACS will make your life easier when it comes to defining new access policies and allowed command sets.