Question

A network administrator wants junior engineers to have full command access on access-layer switches but only read-only (show) commands on core routers. Both device types are already defined in ISE with distinct Network Device Groups. The engineers all belong to a single AD group used in one TACACS+ authorization policy set. What is the MOST effective way to enforce these differentiated command privileges in ISE Device Administration?

Accepted Answer

Create two authorization rules within the Device Admin policy set that match on the same AD group but different Network Device Group conditions, each referencing a different command set

Answer

Create two separate AD groups and assign each engineer to both, then match each group to a different shell profile

Answer

Apply a single command set with a default 'Permit any' and rely on the switch-side privilege levels to restrict the core routers

Answer

Configure two RADIUS authorization profiles that push different dACLs based on the device type