Dell N3200-ON Networking N-Series Switches User Guide version 6.8.0 - Page 302

TACACS+ Authorization Example-Administrative Profiles The switch should use the same configuration as for the previous authorization example. The TACACS+ server should be configured such that it will send the "roles" attribute. For example: shell:roles=router-admin The above example attribute will give the user access to the commands permitted by the router-admin profile. NOTE: If the priv-lvl attribute is also supplied, the user can also be placed directly into Privileged Exec mode. TACACS+ Authorization Example-Custom Administrative Profile This example creates a custom profile that allows the user to control user access to the switch by configuring a administrative profile that only allows access to AAA related commands. Use the following commands to create the administrative profile: 1 Create an administrative profile called "aaa" and place the user in adminprofile-config mode. console#config console(config)#admin-profile aaa 2 Enter rule number permit command regex commands to allows any command that matches the regular expression. The command rules use regular expressions as implemented by Henry Spencer's regex library (the POSIX 1003.2 compliant version). In the regular expressions used in this example, the caret (^) matches the null string at the beginning of a line, the period (.) matches any single character, and the asterisk (*) repeats the previous match zero or more times. console(config)#rule 99 permit command "^show aaa .*" console(admin-profile)#rule 98 permit command "^show authentication .*" console(admin-profile)#rule 97 permit command "^show authorization .*" console(admin-profile)#rule 96 permit command "^show accounting .*" 302 Authentication, Authorization, and Accounting