TACACS+ and authorization "conf-t" commands (IOS)

Question

Hi
Is it possible to do authorization for IOS commands ("conf-t mode") on the TACACS + service without having to keep strings as "privilege configure level 3 interface" in the cisco running config?
Authorization for exec mode commands works well but I need the same for the commands of conf-t mode.
For example tac_plus.conf:
I need something like this (fictional syntax):
    service = configure {
       cmd = interface { permit FastEthernet .* }
       cmd = switchport { deny access .* }
it's already works well:
    service = exec {
       priv-lvl = 3
    cmd = ping { permit .* }
    cmd = wrire { deny memory }
Thank you for any ideas.

Answer 1

Hi Oleg,
here,as you said the commands like ping,show or any other commands in privilege level are authorized with tacacs+ server.but if you want to authorize in global configuration mode then you need to give an extra command
"acs#aaa authorization config-commands"
now after giving you can give any global configuration commands like
"acs(config)#interface FastEthernet "
either you permit or deny.this command gets  authorizes with tacacs+ server.
-thanks,
Rajiv