Question

A network engineer configures TACACS+ device administration in Cisco ISE for a group of IOS switches. A command set named 'NetOps-Commands' explicitly permits 'show' and 'configure terminal' but includes no other entries, and the 'Unmatched Commands' setting in that command set is left as its default. A technician logs in, is authorized by the shell profile, and successfully runs 'show running-config'. However, when the technician attempts to run 'reload', the command is rejected. What is the reason 'reload' is denied?

Accepted Answer

The command set's 'Unmatched Commands' default is set to Deny, so any command not explicitly permitted is rejected.

Answer

The shell profile privilege level was set below 15, which strips the ability to run 'reload' regardless of the command set.

Answer

TACACS+ command authorization only supports 'show' and 'configure' commands; 'reload' must be authorized via RADIUS.

Answer

The switch fell back to local authorization because ISE returned no explicit rule for 'reload'.