ACS shell authorization

Question

IS it possible to configure shell authorization when the privelege level is set to anything less than 15
What i am doing right now is configuring a level 15 access and restricting the commands through shell sets. When i try to assign any other privelege level it doesn't seem to work.
HTH
Narayan

Answer 1

Narayan,
Lets say you assign a privilege level of 10 to the user on the AAA server. The user will log on to the device at level 10 but "sh ip int br" and "sh int" are level 15 commands, hence he will not be able to use them.
So what we will need to do is reduce the privilege level of the "sh ip int br" and "sh int" commands on the device itself to level 10 using "privilege" command in the global configuration mode.
After doing this, only "sh ip int br" and "sh int" commands will be available at level 10 and not other privilege 15 commands.
Now further if you want Group a to execute only "sh ip int br" and Group b to execute only "sh int" then you can apply command authorization for level 10.
Hope this helps