ACS 5.3 - comman sets not working

We installed ACS 5.3 on Vmware -cent os ,  and a cisco router is configured to authenticate to this TACACS+ server , 
i am able to login to router using the specified TACACS username ./ password and able to see the hits also as below in the policy ,
But the Command sets are not working as definded, pls help me to find the problem..
Filter:
StatusNameIdentity GroupNDG:LocationNDG:Device TypeTime And DateCommand SetsShell ProfileHit Counts
Match if:
EqualsNot Equals
EnabledDisabledMonitor Only
Status
Name
Conditions
Results
Hit Count
Identity Group
NDG:Location
NDG:Device Type
Time And Date
Command Sets
Shell Profile
1
RO ACCESS
in All Groups:READ ONLY ACCESS
in All Locations
in All Device Types
-ANY-
READ ONLY POLICY
RO SHELL
10
2
RESTRICTED ACCESS
in All Groups:RESTRICTED ACCESS
in All Locations
in All Device Types
-ANY-
RESTRICTED USER POLICY
Permit Access
1
3
SUPER ADMIN ACCESS
in All Groups:FULL ACCESS
in All Locations
in All Device Types
-ANY-
PERMIT ALL POLICY
Permit Access
0

Logs for such a RO-read only user login
AAA Protocol > TACACS+ Authentication Details
Date :
August 27, 2012
Generated on August 28, 2012 7:13:37 AM UTC
Authentication Details
Status:
Passed
Failure Reason:
Logged At:
Aug 27, 2012 12:18 PM
ACS Time:
Aug 27, 2012 12:18 PM
ACS Instance:
acsserver
Authentication Method:
PAP_ASCII
Authentication Type:
ASCII
Privilege Level:
15
User
Username:
muthu
Remote Address:
172.20.1.25
Network Device
Network Device:
Default Network Device
Network Device IP Address:
192.168.251.26
Network Device Groups:
Device Type:All Device Types, Location:All Locations
Access Policy
Access Service:
TAFE POLICY1
Identity Store:
Internal Users
Selected Shell Profile:
RO SHELL
Active Directory Domain:
Identity Group:
All Groups:READ ONLY ACCESS
Access Service Selection Matched Rule :
Rule-2
Identity Policy Matched Rule:
Default
Selected Identity Stores:
Internal Users, Internal Users
Query Identity Stores:
Selected Query Identity Stores:
Group Mapping Policy Matched Rule:
Default
Authorization Policy Matched Rule:
RO ACCESS
Authorization Exception Policy Matched Rule:
Other
ACS Session ID:
acsserver/132692348/212
Service:
Login
AV Pairs:
Response Time:
4
Other Attributes:
ACSVersion=acs-5.3.0.40-B.839
ConfigVersionId=97
Protocol=Tacacs
Type=Authentication
Action=Login
Port=tty194
Action=Login
Port=tty194
UserIdentityGroup=IdentityGroup:All Groups:READ ONLY ACCESS
Authentication Result
Type=Authentication
Authen-Reply-Status=Pass
Steps
Get TACACS+ default network device setting.
Received TACACS+ Authentication START Request
Evaluating Service Selection Policy
Matched rule
Selected Access Service - TAFE POLICY1
Returned TACACS+ Authentication Reply
Get TACACS+ default network device setting.
Received TACACS+ Authentication CONTINUE Request
Using previously selected Access Service
Evaluating Identity Policy
Matched Default Rule
Selected Identity Store - Internal Users
Looking up User in Internal Users IDStore - muthu
Found User in Internal Users IDStore
TACACS+ will use the password prompt from global TACACS+ configuration.
Returned TACACS+ Authentication Reply
Get TACACS+ default network device setting.
Received TACACS+ Authentication CONTINUE Request
Using previously selected Access Service
Evaluating Identity Policy
Matched Default Rule
Selected Identity Store - Internal Users
Looking up User in Internal Users IDStore - muthu
Found User in Internal Users IDStore
Authentication Passed
Evaluating Group Mapping Policy
Matched Default Rule
Evaluating Exception Authorization Policy
No rule was matched
Evaluating Authorization Policy
Matched rule
Returned TACACS+ Authentication Reply
Additional Details
Diagnostics ACS Configuration Changes

Similar Messages

  • Command Sets not working on ACS 5.1

    I'm running ACS 5-1-0-44-3.
    I have everything running properly on ACS 5.1.  I'd like to implement command sets for selected users and groups.  Under Access Policies -> Device Admin-> Authorization I have Command Sets selected.  The cisco provided is DenyAllCommands.  I have this command set running on all groups and every groups is still able to issue any command they wish.  I've also created a "show_only" command set that I've issued one group and they are still able to do conf t or any other command.
    Am I missing something?
    Do you need to reference the command set name under the shell profiles?
    Its my understanding that all you have to do is reference it in "Authorization" in the rules under Device Admin.
    I can understand a custom command set not working because of user error but DenyAllCommands should work.
    Anyone have any ideas?
    I have already re-patched the ACS
    Stopped and started services.
    And it seems like Command Sets is the only not referenced in the logs

    I do it a lot 
    could you paste screnshot of your command set?
    I've recently met another issue,
    with my command set definition as below (as you can see its very simple):
    almost every show is blocked (as suspected) but not "show run" (which is strange for me)

  • Purchase Order Goods Receipt quantity tolerance setting not working.

    Team,
    We are using the IS-Oil solution, ECC 6.0 REL 605 SP LEVEL 009 .
    The issue that I have is as follows:
    Purchase Order Goods Receipt quantity tolerance setting not working, I had set up a 10% tolerance on QTY received in the GR process via the PIR and also the Purchase Value Key in the  material master and also changed the message to a warning in OMCQ for message number M0722.
    I  had performed a similar configuration and master data maintenance on a different NON IS-OIL client install and it worked fine.
    I believe it is the IS-OIL component in the Inventory update portion of the GR process that is causing the error.
    I have searched for OSS notes, however they mention that there is no solution.
    Setting the PO line item as Unlimited will not be best practice for the business and will not be used.
    Has anyone come across this issue? and how was it resolved, your help and guidance will be greatly appreciated.
    Thanks

    Hello,
    Please check the Tolerance levels in O588 
    Also you can use the BAdI OIB_QCI_ROUND_QTY: A new method, CHECK_TOLERANCE
    Best Regards,
    R.Brahmankar

  • IPhone 6 Battery Usage setting not working.

    When I go to my setting and check my Battery Usage setting it states: "Battery information will be available after using iPhone for a few minutes". I've been using it for hours and I get the same response when I go to the setting. I've turned off my phone multiple times to see if that would resolve it, but it hasn't. Is anyone else experiencing this behavior?

    Hello.
    I have the same problem. iPhone 5, iOS8.0.2, used for a few days - still no usage statistics, only "Battery information will be available after using iPhone for a few minutes".
    I tried restore iPhone (DFU) without restoring backup from iCloud/iTunes, resets, hard-resets, erase all settings, drain battery to 0% and charge to 100% overnight etc. - nothing helps.
    I wrote to the Apple about this problem.
    Here is the page that you can use to contact with Apple and report a bug - https://www.apple.com/feedback/iphone.html
    Please, give the title of "iOS8 battery usage statistics not working" (or something like that), choose the "Bug ​​report" and describe the problem. Perhaps it will make that Apple will eliminate this problem in the next version of iOS. More report - greater chance.
    Regards 

  • Working Sets not working

    Has anyone got Working Sets to work with Flash Builder 4.5 for PHP as described here:
    http://help.adobe.com/en_US/flashbuilder/using/WSc5cd04c102ae3e97bf51ac512e1410bae5-7ff6.h tml
    I created an entirely new workspace to see if that might be the issue, but it was not.
    I created a ticket.
    https://bugs.adobe.com/jira/browse/FB-31092
    Edited: Somehow the above bug either wasn't saved or got deleted.  Here is the new link: https://bugs.adobe.com/jira/browse/FB-31189

    I found a workaround.  After Flash Builder for PHP loads, close the Package Explorer that has the broken working sets.  Then open it back up by going to Window --> Show View --> Package Explorer. 

  • Multiple headphone sets not working?

    I just recently received a replacement iPod Nano because my last one glitched itself and wouldn't respond to anything a consultant had me do. It's worked great since I got it. The last time I listened to it was Friday [the 6th], and the headphones worked just fine. Today [the 8th] I went to listen to it, and sound only came out of the left speaker. At first, I thought that it was only the headphones, and I just needed a new pair. Well, I went to use another pair I had [for an Mp3 player] and once again, sound came out through just the left speaker. That's two sets that would not work for the right headphone speaker. Could anything be wrong inside this iPod? Is there anything I can do to fix it? I would rather not have to have it replaced, since this IS a replacement iPod.
    Thank you for any help!

    Your headphone jack in the iPod is broken, you will need to get it replaced. You don't wrap your headphone cord around your iPod while it is plugged in, do you?

  • "Values only from infoprovider"  setting not working

    Hey Guys,
    I am on 2004s backend and 3.5 frontend. I need to restrict values of a characteristic on F4 and report only to infoprovider values. I know there is a straight setting in Info-object maintenance screen where you can specify in Bex tab, Only values from Infoprovider.
    But unfortunately its not working for me. Even after doing this setting, I continue to get values from master data table on F4 screen.
    What could be missing?
    Please note that my info-object on which I am applying this setting also has a compounding characterstic, which makes 2 values as key to appear on selection screen.
    Any suggestions/advice would be of great help.
    Thanks
    Abhijit

    BTW, the firmware was run and the keyboard AND audio did work prior to and after the firmware update. It just suddenly stopped.

  • Correlation sets not working

    I have a requirement as below :
    I am working on Jdev 1.5 version and BPEL 2.0 specification. I have an if-else condition in my BPEL. In the if condition I have a while loop with 2 correlation sets, Correlation_1 and Correlation_2. Now in the else condition, I have again created 2 more correlation sets Correlation_3 and Correlation_4. The Property Aliases of these correlation sets, Correlation_1 and Correlation_3 are same, but I have created them separately. Same is the case with Correlation_2 and Correlation_4. Now when I use the correlation set only in the if loop it works fine, but when I use in both the if and else condition, the correlation does not work.
    I have even tried creating a scope for the else condition, which is not in any while loop, but that scope is not visible.
    Can someone please suggest something for this?

    +... post moved from the Database General Questions forum,+
    to the BPEL forum...
    (Why you chose a database forum for your BPEL question is confusing, particularly after resurrecting a 2007 thread in that BPEL forum and trying to hijack it away -- the hijack post has been deleted, by the way.)

  • Show Keyboard & Character Viewers setting not working

    I like to have access to the Keyboard and Character Viewers in the menu bar; however, the setting on my new MacBook does not work. I have checked the "Show Keyboard & Character Viewers in menu bar" many times and it unchecks itself as soon as I leave the Keyboard tab of the Keyboard setttings in System Preferences.
    Could a preference file be corrupted? (I migrated data from my old MacBook (OS 10.7) to my new MacBook (10.9). Perhaps this has something to do with the problem?)
    Or, is there a command line way to show the preference that might stick better than the checkbox in the System Preferences?
    Any insights would be appreciated.
    Thanks,
    -Robert.

    BikerBob wrote:
    The Input Sources menu has to be enabled to show the Keyboard & Character Views menu, which appears under the Input Sources menu. This was not the case in Mac OS 10.7, which I was previously using.
    However, it is odd that the Keyboard & Character Views option is not greyed out in the Keyboard tab when the Input Sources menu is not enabled.
    Indeed, the way Apple has done this in Mavericks seems both odd and cumbersome.   I think it would be worth telling them so at
    http://www.apple.com/feedback
    The official instructions assume you have already enabled the input sources menu:
    http://support.apple.com/kb/PH13746

  • Restore last view setting not working in version XI

    When reopening documents the new version XI, Adobe keeps opening my documents on page one. Though I have gone to preferences\documents and checked the box for restoring last view setting when reopening documents. Is this a bug that needs fixing? I already uninstalled and re-downloaded the program. It still will not work correctly.

    it still does not work for me. It is set to 1 minute. I have tried it in a number of pdf's. I left it longer than 1 minute and it still does not work. It does not work for any of my pdf's but it DID work in previous versions. I guess I will just go back to version 9! They should be able to fix this though. I also re-downloaded, deleted the program, and loaded it again.... still doesn't work!!!

  • Keyword search on collection set not working for specific sub-collections

    I am having the following problem:
    When I do a search (Text->Keyword->Contains All-> for a keyword (in my
    case "Fave"), it does not work if I select the collection set that contains the
    collection that contains the images with that keyword.
    It DOES work if I select the folder, parent folder, or just the
    collection that contains the image. Just not the collection set.
    The details of how this came about are below - and are probably a
    little unusual, but not outside the realm of what should be allowed.
    Is there a way to reset/reindex keywords in a collection?
    Specifically:
    images lives in collection C1 which is part of collection set
    CS1. It lives in F1 (on disk and in LR) which is in parent folder
    PF1. A keyword search works when I select F1 or PF1 or C1, but NOT
    when I select CS1
    This happens on a set of folders that went through the following
    (totally allowable?) sequence:
    I am running on a Windows 7 64 bit machine with 64 bit LR3.3
    I have an internal disk where I keep my catalog and images. Windows
    mounts this as P:. I also mount it on my Desktop as the folder
    "Lightroom" (this allows me to change to a larger external disk
    by mounting it in the same place without changing the locations of
    all the files).
    I mistakenly imported pics into P:/PF1 rather than
    C:/.../Desktop/Lightroom/PF1 as I normally do.
    Added keywords made a collection C1 put the images in it, and added
    C1 to collection set CS1
    Having realized my import mistake (P: rather than
    C:/.../Desktop/Lightroom), I went in the Folders->P: section and did
    an Update Folder Location on F1 to C:/.../Desktop/Lightroom/F1
    This seemed to be all fine, but this weird Keyword search problem
    resulted.
    I have tried the following things:
    o Deleting and re-adding Keywords in the Collection
    o Deleting and re-adding the Keywords in the Folder
    o Renaming and relocating the Folder
    o Create new collection C2 and move pics from F1 into C2

    See my simplified recipe for reproducing this bug (which turns out not to be related to the drive mounting I described):
    http://forums.adobe.com/thread/764538

  • Secure Empty Trash Setting not working HELP!!!

    Im trying to turn off the secure empty trash I dont know how it got turned on
    but its not working
    Ive tried going to Finder > Preference > advanced > uncheck the secure empty box
    but it doesnt work it keeps asking me if im sure to delete the item
    I dont want secure empty trash i like keeping the files for a while just in case
    HELP please

    Click on the item in the Finder's sidebar with the house icon and verify that you are able to write to this folder in the Ownership & Permissions section of the Get Info window, and that it isn't locked; if it is already set this way and you get that error, open the Terminal in the /Applications/Utilities/ folder and run the following:
    mkdir ~/.Trash
    If you get a message stating that the folder exists, run the following:
    sudo chown $UID ~/.Trash
    chmod u+rwx ~/.Trash
    The first command in the second set will prompt you for your administrator password; nothing will appear in the Terminal window while it is being typed. In either case, click on the Finder icon in the Dock with the Control and Option keys pressed, and relaunch it.
    (55512)

  • Where left off video setting not working in ios 7

    Since upgrading to ios 7 the 'Where left off' stting on the Video is not working. I have turned it off/on and it is ticked. Every time I switch off the iPad 2 and then turn it on again the last video played place is not remembered - it always resets at the beginning. This happens on my iPhone 4s as well as that is at ios 7 now as well. Both devices were OK with remembering the video place before upgrading.
    The videos are produced from Handbrake and not store purchases but I dont have any store purchases to try it out.
    Anyone else seeing this (or not)
    Paul

    I have this problem too since IOS7, except I don't have to switch my ipad off, I simply have to have not watched a video for a bit and when I switch back to the vid app it forgets all over again. VLC looks to be the much better app

  • New Storage Check setting not working - Lumia 920

    I received the new update yesterday but the new "Storage Check" doesn't work.  I see it in settings but when I click on it  it looks like it is going to do something (page flip animation) but then it goes right back to the settings.  Does anyone have this issue or know how to fix it?  I have done a soft reset and turned it off a few times.  I do not want to do a hard reset because I recently did this and I have the phone the way I like it.

    Guys, I'm form India.
    Just updated my Lumia 920 to new firmware version 1308.0001
    As reported by others, I have the same problem. My ''storage check'' option is not working at all!
    It keeps on loading.
    What to do?? Please help!
    Attaching a screen shot.
    Attachments:
    wp_ss_20130409_0002.png ‏110 KB
    wp_ss_20130409_0003.png ‏100 KB

  • NWDS 7.3 Mobile frame work log in page setting not working

    Hi All,
      I am new in SAP portal. My team try confired mobile frame work log in page not working. We using jquery mobile 1.1 and jquery core 1.6. Pls send me your feedback ASAP.
    regards,
    kathiresh

    Hi,
    Changing the Login Page Image in CE7.1
    -->Change the image with name unchanged in the path
    <installdirectory>usrsapCE1J00j2eeclusterappssap.comcom.sap.security.core.logonservlet_jsplogon_ui_resources
    ootlayout
    here you can change the branding-image,branding text...... the size sould be same
    -->Restart your server.
    Note: See that the pixels of the image should be equal to that of the existing image.
    Please look at this [Document|/thread/1330264 [original link is broken];
    and [Help|http://help.sap.com/saphelp_nwce10/helpdata/en/23/c0e240beb0702ae10000000a155106/frameset.htm]
    Hope this helps u.
    Best Regards
    Vijay K

Maybe you are looking for

  • Help on 10g IMP.EXE needed

    Hello, I'm running Oracle Database 10g Enterprise Edition 10.2.0.1.0 and Oracle Developer Suite 10g Release 2, both on the same machine, running Windows XP SP3, for learning propose. The system was a clean install, only Windows, oracle database and o

  • Satellite P25-S520 - DVD drive is not working properly

    Fix DVD Drive or buy external drive My DVD drive is not working properly, in fact it may never have been working proper. Recently I tried to back up my PC to a DVD using Norton 360. Norton did not recognize the DVD was present. I then tried writing a

  • Error Interface Mapping Not found..

    Hi Friends, I am simply using file to ABAP proxy scenario. I am getting error as : This I am getting while test my configuration at Scenario level  Tools  - > Test Configuration.. Interface Mapping  :     Runtime error com.sap.aii.utilxi.misc.api.Bas

  • ICloud music HELP!

    When I first got my Iphone 5, I was able to access my entire music library on my phone through my music icon and icloud....but now I can only access one album (the most recent one I bought from my phone). What happened and how do I get it back?  I've

  • P.O. Release

    Dear all,              I WANT TO RELEASE PO BUT DONT KNOW HOW TO DO AS I M NOT A MM CONSULTANT. IS THERE ANY TCODE?              I THANKS U ALL IN ADVANCE FOR UR HELP. REGARDS AJIT K SINGH