Question

An engineer is configuring TACACS+ device administration in ISE for a group of switches. The authorization policy rule for the 'JuniorNetOps' group references two command sets: 'CS-ShowOnly' (permits 'show' commands, denies all others) and 'CS-IntConfig' (permits 'configure terminal' and 'interface' commands). Both command sets are added to the same authorization result. When a junior engineer runs 'interface GigabitEthernet1/0/1', the command is permitted. When they run 'reload', it is denied. How does ISE evaluate multiple command sets attached to a single authorization result?

Accepted Answer

ISE permits a command if any attached command set permits it, and denies only when no command set permits and at least one explicitly denies (or none match)

Answer

ISE evaluates command sets top-to-bottom and stops at the first command set, ignoring the second entirely

Answer

ISE requires a command to be permitted by every attached command set before allowing it

Answer

ISE merges only the shell profile privilege level and ignores additional command sets in the same result