ClearPass TACACS+ Cisco switch AAA Active directory

ClearPass version: 6.6.0.81015

ClearPass IP: 192.168.32.18
Cisco Switch IP : 192.168.32.13

Setup:

Group Name : VDI-Group1
Group Name : VDI_Group2

when a user member of group “VDI-Group1” log in to the switch, he/she will get privileges 15 , When an user member of group “VDI_Group2” log in will get privileges 3 . Also we will do some command restriction using ClearPass command authorization.




ClearPass:


Add the NAD to ClearPass:

Configuration >> Network >> Devices






Configuration » Enforcement » Profiles »


Add new enforcement profile: I named it “3850 Pri 3”












Create another Profile

Configuration » Enforcement » Profiles » Edit Enforcement Profile [ I named it “3850 Cisco Pri 15’]



















Create Two Roles:

Configuration » Identity » Roles

ClearPass Role is nothing but a TAG. You could name it whatever you like. But it is better to name it as you could understand.






Create Role Mapping:

Configuration » Identity » Role Mappings I named it “TAC_role“

Role Mapping TAG the user so that we could use them later with Policies. For example








If the user is the member of VDI-Group1, Role Mapping TAG them to cpass_admin. We will use this TAG later in policies to enforce rule.



Configuration » Enforcement » Policies »

Create an Enforcement Policies. I named it “3850 Policy”






 
 
These are the two Tips role.

1. If ClearPass authenticated a user, it will check the user role TAG from Role mapping and TAG then according to our Role Map.

2. ClearPass will then check the user TAG [TIPS Role] and enforce proper action as we selected.









Now we need Create a Service. Which bring all together!

Configuration » Services »
























##### #### ### Cisco Switch Part ####

tacacs server ARUBA 
  address ipv4 192.168.32.18 
  key 123456
aaa group server tacacs+ CPASS 
  server name ARUBA
tacacs-server directed-request



#aaa new-model
#aaa authentication login default group tacacs+ local


#aaa authentication enable default group tacacs+ enable 

 
-- These two commands help to enabel commands enforcement  --


#aaa authorization config-commands
#aaa authorization commands 15 default group tacacs+ local if-authenticated


############### End ######################

Read more :
Ref: http://packetlife.net/blog/2010/sep/27/basic-aaa-configuration-ios/