000033955 - How to configure RADIUS profiles to segment user permissions in Cisco devices for Authentication Manager 8.x Server

Document created by RSA Customer Support Employee on Jun 6, 2017
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000033955
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.1 or later
 
Issue
  • Customer network devices are getting authenticated through RSA Authentication Manager using an Active Directory account.
  • Currently these users have full access to the network devices.
  • The requirement is to grant Read-Write access for administrative users while Read-Only access for other users, the Service Desk for example.
Resolution
  1.  Create the RSA RADIUS client for Cisco network device. In the Security Console.  
    1. Click RADIUS > RADIUS Clients > Add New.  
    2. Important: For the Make/Model option select Cisco IOS 11.1 or later.
    3. Complete the form and click Save with associated agent.  .
    4. Click Save. 
  2. In the Security Console, click RADIUS > RADIUS Profiles > Add New.
  3. Create a RADIUS Profile, selecting the Return List attribute of Cisco-AVPAIR then configure the value with shell:priv-lvl=<integer between 1 to 15>. The administrative attribute for Read-Write should be either
    1. The av-pair, that is:   

shell:priv-lvl=15


or

  1. The attribute for read-only can be the av-pair:

shell:priv-lvl=1


      Note that the priv-lvl value ranges from 1 to 15 depending on your router enable privilege config.
      The 15 represents full admin access into the Cisco device and the lower values represent a lessor privilege than 15/full admin access.

  1. In the Security Console, click RADIUS > RADIUS Profiles > Manage Existing and select the profile from the context menu.
  2. Select Associated Users.
  3. Click Assign to More.
  4. Search for the users to link to this profile and select them.
  5. Click Assign Profile.
  6. Verify authentication with the user ID.

Attachments

    Outcomes