Question

A network administrator is configuring TACACS+ device administration in Cisco ISE. Senior engineers who belong to the Active Directory group 'NetOps-Senior' must be granted full privilege-15 shell access with no command restrictions, while junior engineers in 'NetOps-Junior' should log in at privilege 15 but only be permitted to run 'show' commands. Both groups authenticate against the same AD join point and connect to the same IOS switches. Which combination of ISE Device Admin policy components correctly enforces this differentiated access?

Accepted Answer

Create one shell profile granting privilege 15 and reference it for both groups, then apply separate command sets — a permissive one for NetOps-Senior and a 'show'-only command set for NetOps-Junior — in the respective authorization rules.

Answer

Create two shell profiles (privilege 15 and privilege 1) and assign command sets only to the senior engineers, letting the junior engineers rely on the device's local privilege enforcement.

Answer

Use a single authorization rule with one command set that permits all commands, and control access differences by assigning different DACLs to each AD group.

Answer

Assign the senior engineers a shell profile with privilege 15 and the junior engineers a shell profile with privilege 7, relying on IOS command-to-privilege mappings without any command sets.