Cisco :: User Privilege Level For Configuration Backup With PI 1.2

Feb 15, 2013

We have more than 50 devices handling by PI 1.2 (testing) I like to know how to do configuration archiving with user who doesn't have write privilege.
  
I tried like this.
  
username john privilege 6 password cisco privilege exec level 6 show running-config
  
(result) show run --> blank
 
  I tried this user with one of switch in PI 1.2. It did not do configuration backup
 
username inout password inout username inout privilege 15 autocommand show running-config
  
(result) once logged in, it automatically showed running-config. However when I tried with PI 1.2 with this user (inout). I couldn't do configuration back.
 
reference [URL]
  
create certain user with read-only privilege while PI 1.2 is able to do configuration archiving ?

View 0 Replies


ADVERTISEMENT

Cisco AAA/Identity/Nac :: Can't Seem To Enable In ASA With Non-15 Privilege Level User Configured In ACS 4.2

Apr 29, 2011

I can't seem to enable in ASA with a non-15 privilege level user configured in ACS 4.2 (tacacs).When I enable in IOS device, it enables and "show privilege" shows level 10 as expected. ACS should be configured correctly as it works fine with IOS. User is not set with explicit settings. Group is set with "max enable level" 15 and "shell exec priv level" 15. The enable password is set to the internal ACS PAP password. Works fine in IOS.When I enable in ASA, it fails to enable, and ACS log says "Tacacs+ enable privilege too low". I suspect that ASA tries to enable into level 15 explicitely. If I try to issue "enable 10" command in ASA it says: Enabling to privilege levels is not allowed when configured for AAA authentication. Use 'enable' only. [code]

View 2 Replies View Related

Cisco LAN :: 3750 Configure Read Access Via User-defined Privilege Level

Mar 11, 2013

I´m looking for the best configuration to restrict a user to read-only. The restriction should be configured via CLI not TACACS+.

-Hardware: 3750 (probably not interesting for this question)
-Oldest IOS: 12.2(53)SE1
 
The user should be allowed to: see the running-configurationtrigger all kinds of show-commandsping and traceroute from the device.The user should not be allowed to: upload/delete/rename files on the flash-memoryget into level 15 (not sure if I can avoid this)all other commands despite those from level 1 and those specified above.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 RSA Users Not Getting Level 15 Privilege?

Jun 13, 2011

I have cisco ACS 5.2 and external identity source as RSA secure ID.Currently when the RSA user login to AAA Network devices, User id & passcode prompt coming after giving the credential its going to user exec mode.Then after "enable" command again asking for Passcode giving passcode then user able to logged in successfully.
 
I need RSA users to get direct privlege level15 (privlege mode) ? no need to ask enable password ? 

I checked this for local ACS users it is working and loca users getting directly privelege mode access...

View 2 Replies View Related

Cisco Security :: ASDM 5.2 Command Privilege Level For Vpns

Sep 21, 2011

We have an ADSM (version 5.2(3) ) . In ASA ( version 7.2(3)) we are working with routing, access restriction and configuring IPSEC vpn with integration to our AD. We need to get two diferent profiles: one for networking administrators, who are going to manage routing, acls and have the root for ASA, and the other  profile is going to be for the vpn administrators. As I read from the ASDM 6.0 user guide is posible define command privilege level. So do you consider posible to define a particular level for all the command related with ipsec vpn (Create, Modify and Delete) and asociate that particular level with the user for vpn administration.

View 1 Replies View Related

Cisco WAN :: 861 SSH / Telnet Privilege Exec Level 15 Enable Not Working?

Aug 10, 2011

I have a customer with a 861 ISR.I want to block all the privilege 0 users from access the enable command
 
If i telnet into the device, as a priv=0, enable does not work
If i telnet into the device, as a priv=15, enable does work 
If i telnet into the device, as a priv=0, enable does not work
If i telnet into the device, as a priv=15, enable does not work
  
I have issued the command:privilege exec level 15 enable Should block everyone except 15's from accessing the enable command SSH and TELNET are on the same vty:
 
line con 0
login authentication local_authen
no modem enable
line aux 0
line vty 0 3

[code]....
 
Basically TELNET is following the rules ( priv=0 not allowed to access enable ) but SSH is not following the rules ( both priv=15 and priv=0 cannot access the command ) is there a way from blocking somes users from login in completely?

View 9 Replies View Related

Cisco :: LMS 4.0.1 Authenticate User On Group Base And Assign Different Privilege?

Sep 7, 2011

having LMS 4.0.1 is it possible to authenticate user on a group base and assign different privilege to different groups?. The user's group are available in the LDAP server.Do I have to use a TACACS/RADIUS server between the Ciscoworks LMS and the LDAP repository?

View 1 Replies View Related

Cisco Firewall :: 6513 - Local User And Privilege Levels

Jul 14, 2011

I have FWSM's in Cat 6513's. I have a need to be able to session from the switch to the FWSM by using default account (not local user), at privilege level 15 I further have a need to allow a user read only access by ssh'n into the FWSM...
 
I believe I need to setup a local user, at, say privilege level 5, assign the show command only to privilege level 5, then set the authorization command for that user. So, i think my command sets are as follows to accomplish this:

username <username> password <pw> priv 5
priv command level 5 mode exec command show
aaa auth ssh console LOCAL
aaa auth enable console LOCAL
aaa authorization command LOCAL
 
I think, that this will allow the user at privilege 5 to run only the show command and only by SSH to the FWSM while allow the priv 15 level default login to continue to function properly.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: N5000 Same User In Tacacs / Local Database With Different Privilege

May 15, 2012

i am running NX-OS image n5000-uk9.5.1.3.N1.1.bin on the nexus 5020 platform.i have configured authorization with tacacs+ on ACS server version 5.2 with fall back to switch local database.a user test with priv 15 is craeted on ACS server, password test2 everything works fine, until i create the same username on the local database with privilege 0. ( it doesnt matter if the user in local database was created before user in ACS or after ) e.g.:  username test password test1 role priv-0   (note passwords are different for users in both databases)
 
after i create the same user in local database with privilege 0,if i try to connect to the switch with this username test and password defined on ACS,  i get only privilege 0 authorization, regardless, that ACS server is up and it should be primary way to authenticate and authorizate the user.

View 3 Replies View Related

Cisco :: Backup Configuration On LMS 4.2

Nov 21, 2012

1)how can i backup the configuration on cisco lms 4.2 and to re-imported later when i re-install the lms 4.2
  
2)how can i change the admin password on cisco lms 4.2

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Backup Configuration On ACS 5.2?

Jun 8, 2012

How to backup the configuration on cisco acs 5.2 and how to restore it , if some thing wrong happened

View 7 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.x / How To Backup Configuration

Mar 10, 2013

Cisco ACS 5.x appliance?How to back up Config?What is best way, via TFTP? COPY Startup-config tftp:?COPY Running-config tftp:?I currently use Solarwinds CatTolls to back my Cisco Switches, can I use this for Cisco ACS also?

View 3 Replies View Related

Cisco :: LMS 4.2 Backup Configuration Of Devices

Nov 29, 2012

How to backup the configuration of Cisco devices managed by LMS 4.2 and store it in Folder , than restore it once it need it

View 10 Replies View Related

Cisco Switching/Routing :: How To Backup The Configuration Of ACS 5.3

Mar 15, 2012

how to backup the configuration of ACS 5.3 then restore it on the secondary ACS 5.3 Appliance in order to save time without configure the 2nd Appliance?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Backup ISP Configuration

Jun 13, 2011

I'm having problems configuring an asa 8.2(1) with a backup isp.  I followed the asdm instructions in this document: [URL]
 
I have my backup interface configured as DHCP and the static routes set. Pinging the gateway and other external IP address from the backup interfaces works normally. I have also tried configuring the backup interface as a static address but got the same results.
 
When removing the primary wan link, all traffic stops. When I ping a external DNS, I get these errors in the log: portmap translation creation failed for udp src inside: 192.168.13.23 dst backup:208.67.222.222_type 8, code0)
 
I though this type of error is related to a NAT problem, not sure where to look though.

View 4 Replies View Related

Cisco Wireless :: Backup Configuration On WAP 5508?

Feb 5, 2013

how to backup a Cisco Wireless Access Point Controller 5508.

View 2 Replies View Related

Cisco :: Backup Of Configuration From Nexus Switches 5K And 7K

Dec 4, 2012

I'm busy on configuring the backup of the configuration from Nexus switches 5K and 7K.I have installed COPSSH on my windows server and try to confiugre the sftp credentials. [code] I have tested from the CLI from the switch and i have the issue but if i use the default vrf 'default' it works fine.How can i change the command sent by DCNM to the Nexus in order to specify vrf default and not vrf management ?

View 1 Replies View Related

Cisco :: LMS 4.0.1 - Device Configuration Auto Backup

Mar 6, 2012

Is it possible to create a job what automatically export the devices configs that are in the folder CSCOpxfiles medemushadow? It would be wonderdul if CW could export the .cfg files into a .rar and send in email or something like this.

View 1 Replies View Related

Cisco :: 5508 - NCS Configuration Backup And Restore Of WLC

Jan 10, 2012

I recently tested the process for a customer of defaulting a Cisco WLC to factory configuration and then restoring the configuration from Cisco NCS.  It was not seamless to say the least and I wonder if I have just gone about it the wrong way. 
 
Have have set the NCS platform to configuration sync with the 5508 controllers at 04:00 every day and prior to the controller defaulting I ensured that NCS also reported that the config was in sync. I have also set NCS to complete a tftp backup of the controller every night 23:00 - interestingly though I have no idea where this is stored on the NCS platform ( a VM appliance ) or what it's file name is.
 
Anyway my experiences where as follows:-
1.  defaulted WLC and via serial CLI ended up at the configuration wizard.
2.  Set the correct LAG, management IP, host name that NCS knew this controller by.
3.  To test things just created a dummy WLAN ( SSID ) as I assumed this would be overwritten ( big mistake ! ). 
 
At this point I connected the controller to the network and tried to restore the configuration from the config sync version.

First problem - you have to remember to set up the SNMP community string you were using as it is needed by the configuration sync process.  After adding this to the controller I could push the configuration to the controller.

Second problem - failed to add the first WLAN from the backup as I have added the temporary dummy W LAN via the wizard and NCS reported a conflict.  So had to delete WLAN ID 1 from the WLC GUI directly and then the config push no longer reported this error.

Third problem - for some reason did not add the TACACS server details - reported the error that it could not added them.  I manually added these via a template via NCS and all was well. 

Fourth problem - all but the first WLAN was in the disabled state - had to re-enable all of the WLANs. 

Fifth problem - any default items I had disabled or removed have not been saved - therefore I have removed the public and private SNMP communities - but these were still on the WLC after the restore.  I have disabled unused ports not in the LAG as they show an error in NCS - these where not disabled after the restore.
 
So all in all not a very satisfactory restore process from NCS to an defaulted WLC ( meant to simulate to the customer what would be needed if they had to replace a controller due to hardware failure ).

View 1 Replies View Related

Cisco VPN :: ASA 5505 Backup Configuration To TFTP Server?

Oct 4, 2011

Is there a way to backup the configuration file to a tftp server? I've tried "copy start tftp" and copy run tftp". No luck, I get an error message.

View 1 Replies View Related

Cisco :: LMS 4.2.1 - Backup Configuration Of WS-C4503-E Version Cat4500e

Oct 11, 2012

I have a Cisco LMS 4.2.1 on a Windows 2008 Server R2 platform and I would like to backup the configuration of my WS-C4503-E version cat4500e-universalk9.SPA.03.03.01.SG.151-1.SG1I create the job in Configuration > Configuration Archive > Synchronization and after the execution of the job, I check th status in Admin > Job > Browser: I don't know why the archive doesn't exist. It's a newly install.

View 2 Replies View Related

Cisco Application :: ACE-20 Module - Automated Backup Of Configuration

Feb 4, 2010

I am currently stuck to setup an automated configuration backup for ACE Blades. I found a script to backup the ACE from the Cisco ANM box but unfortunately I am not very familiar with Linux. (script) in place, to "pull" the ACE config from a Microsoft system ?
 
System State:
ACE IOS A2.(1).5

View 2 Replies View Related

Cisco Switching/Routing :: 2960G Don't Have A Backup To Configuration In PC

Dec 30, 2011

I have 2960G that in rommon status.I need that the switch work in 0x2102 (regular mode).I don't have a backup to configutratuio in my PC.I do wr before the switch go to rommon (startup config).What to do in order to the switch will be in 0x2102 (regular mode) with the same configuration( before the switch go to rommon)?

View 1 Replies View Related

Cisco :: 2504 WLC To Trigger Configuration Backup When It Is Saved

Apr 17, 2013

I can't seem to find and answer to this, but is it possible on a 2504 WLC to trigger a configuration backup when the configuration is saved like on Cisco routers and switches?

View 2 Replies View Related

Cisco Firewall :: ASA 5505 - Backup ISP Link Configuration?

Jan 28, 2013

I'm working on setting up a backup link for our ASA 5505 and I've followed these directions:  [URL]
 
The backup ISP gives us a dynamic address, however, when I enable the backup ISP's interface on the ASA, my vpn tunnels drop. As soon as I disable the backup interface, the tunnels come back up. I'm attempting to configure this across one of these tunnels, so obviously this is an issue, as is the fact that other people need the tunnels as well. I'm not sure what I did to make this happen, but I've been over the config many times and can't see anything different from the instructions in the link above.
 
I thought it might be trying to route traffic across the backup interface, but my primary interface is tracked and has SLA running on it, so I would assume it wouldn't roll over onto the backup interface.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 Configuration Backup With Archive?

Nov 15, 2011

On our cisco 3750 switches we can take config backups with the archive command. After every "write mem" it rights the config to our backup server. We would like to do this also for our asa 5520 with version 8.2(2). I also searched in the command reference guide, but I can't seem to find the proper command to do it.

View 2 Replies View Related

Cisco Firewall :: Best Practice For Log Configuration And Backup In ASA5505

Feb 20, 2011

I like to take log backup in ASA.. and i like to check whether any attack pattern is there?? how could i do this...?Also how could i do a best practise for this?

View 12 Replies View Related

Cisco WAN :: 5520 / Backup Internet Link Configuration

Dec 14, 2012

i have two internet links each of which from different ISP and different real ip addresses.Want to make the second backup internet work for Internal and external (AnyConnect) users.
 
my question:  is that applicable to register single A record with different real ip addresses? and also is the AnyConnect method the best solution for them?
 
note: i have single firewall 5520 behind the cable modems.

View 3 Replies View Related

Cisco Application :: ACE 4710 - Context Management / Backup Of Configuration?

Jun 25, 2012

I am looking at management (backup of the configuration) of the ACE 4710 running A4.1, the management software is Cisco Cirrus. The question I have is around the management of the context's, I have a backup of the Admin but would like the user context's also, how this is completed.              

View 3 Replies View Related

Cisco Switching/Routing :: 881 SDSL With ADSL Backup Configuration?

Feb 26, 2012

i'm looking for a cisco 881 configuration with SDSL line as nominal and ADSL as backup.

View 9 Replies View Related

Linksys Cable / DSL :: WAG160N Cannot Restore Configuration Backup

Mar 27, 2010

I have a WAG160N and its seems to have reset to factory defaults, no idea why, but when trying to restore the Configuration Backup all I get is "Restore Failure <Unmatched pid>"

View 2 Replies View Related

Cisco Switches :: File Extension For Download Backup Configuration Sg300-10

May 7, 2012

i want to download an backup of the configuration file of my Cisco sg300-10 but do not know what to call the file extension.. backup.??? backup.img? backup.ros ?

View 4 Replies View Related

Cisco Wireless :: How To Take Backup Of Configuration File For WLAN Controller 4420

Nov 4, 2012

I need to take the backup of configuration file for WLAN Controller 4420, I tried all the possibilities given in the documentation but the backup fails, I have main confusion with the file name to be backedup, i am not able to findout the configuration filename any where even when i use CLI?

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved