I'm having problems understanding the concept of how ACS is supposed to work. Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box. However, anyone w/ a valid LDAP account can authenticate. How exactly do I narrow which LDAP users can authenticate? How do I make it so some users can access some devices, but not others?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8, 2017 at 16:32

1 Answer 1


The most common way is to segregate access based on group membership. Within ACS there is/should be an "Access Policies" menu - I won't go into every detail of configuring ACS here, because that's why there's a manual, but you can essentially define your policies of which groups members can log in (and which group members have access to run which commands) there. In addition, there's also a way to define hierarchy in your actual network devices themselves (via hostnames, "Locations", etc) that can provide further criteria on network device access. ACS is a decent product if you need point-and-click AAA, but there are far cheaper ways to do the same thing if you have staff that know what they're doing (see tac_plus or FreeRADIUS).

Taking some care in defining and laying out elements in your Network Resources/Network Device Groups in ACS will make your life easier when it comes to defining new access policies and allowed command sets.

  • YES! I can vouch for tac_plus as a great alternative. Open source and, believe it or not, much faster than our Cisco ACS (more lightweight).
    – Ryan Foley
    Apr 10, 2014 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.