AAA ACS and Nexus

Question

Hello,
i am setting up tacacs+ aaa on nexus switch.
Using nexus cli i can record all entered commands (see example 1).
Using Cisco Device Manager with the same switch i cannot get a record of entered commands (see example 2).
Via CDM, nexus is using snmpv3 and MD5 for authentication allowing me to type username/password to authenticate.
How can i setup aaa on nexus to provide same level of reporting when using CDM and CLI?
If anyone can provide some config info would be greatly appreciated.
AAA config lines:
feature tacacs+
aaa authentication login default group AAA
aaa accounting default group AAA
tacacs-server host 5.5.5.5 key <key>
aaa group server tacacs+ AAA
    server 5.5.5.5
    use-vrf management
Example 1
22/03/2011,14:45:57,MaxPower,Nexus,terminal length 0 (SUCCESS),0,none,0,10.2.2.44@pts/0,1.1.1.1,
22/03/2011,14:45:57,MaxPower,Nexus,terminal session-timeout 60 (SUCCESS),0,none,0,10.2.2.44@pts/0,1.1.1.1,
22/03/2011,14:45:57,MaxPower,Nexus,sync-snmp-password ******** MaxPower 10.2.2.44 (SUCCESS),0,none,0,10.2.2.44@pts/0,1.1.1.1,
22/03/2011,14:46:02,MaxPower,Nexus,terminal length 0 (SUCCESS),0,none,0,10.2.2.44@pts/3,1.1.1.1,
22/03/2011,14:46:02,MaxPower,Nexus,terminal session-timeout 60 (SUCCESS),0,none,0,10.2.2.44@pts/3,1.1.1.1,
22/03/2011,14:46:03,MaxPower,Nexus,sync-snmp-password ******** MaxPower 10.2.2.44 (SUCCESS),0,none,0,10.2.2.44@pts/3,1.1.1.1,
22/03/2011,14:46:11,MaxPower,Nexus,target (name:10.2.2.44/2162/0 address:10.2.2.44:2162 timeout:1500 retry:3 tagList:trap params:10.2.2.44/2162/0) added ,0,none,0,snmp_3277_10.2.2.44,1.1.1.1,
22/03/2011,14:46:16,MaxPower,Nexus,target (name:10.2.2.44/2162/0 address:10.2.2.44:2162 timeout:1500 retry:3 tagList:trap params:10.2.2.44/2162/0) added ,0,none,0,snmp_3279_10.2.2.44,1.1.1.1,
Example 2
22/03/2011,14:46:36,MaxPower,ACSGroup,write <cr>,15,shell,tty2,2,10.10.10.15,
22/03/2011,14:48:26,MaxPower,ACSGroup,configure terminal <cr>,15,shell,tty1,29,10.10.10.34,
22/03/2011,14:49:06,MaxPower,ACSGroup,aaa group server tacacs+ AAA <cr>,15,shell,tty1,31,10.10.10.34,

Answer 1

Hi
there are many ways to achieve this, but the *correct* and most scalable is to enable command authorisation on your devices.
In ACS create some groups based on the permissions levels each group should have.
In the groups enable the shell (exec) service.
At this point you can either list the denied commands for certains groups right in the group edit page itself.
Alternatively, you can created Device Command Sets in the share profiles UI. These are more flexible because inside a single group you cap map to different DCSs based on the device being managed (either by device ip or by network device group)
Its all there in the ACS docs!
Good luck.