An engineer is configuring TACACS+ within Cisco ISE for use with a non-Cisco network device. They need to send special attributes in the Access-Accept response to ensure that the users are given the appropriate access. What must be configured to accomplish this'?

In Cisco ISE, a TACACS+ Shell Profile is the specific configuration element used to define a collection of authorization attributes that are sent to a network device during the authentication phase. When a user successfully authenticates, ISE sends the attributes contained within the assigned Shell Profile in the TACACS+ Access-Accept packet. For non-Cisco devices, which may require vendor-specific attributes to define user roles or privilege levels, custom attributes can be created and added to these Shell Profiles. This directly accomplishes the goal of sending special attributes to assign appropriate access.

A. dACLs to enforce the various access policies for the users dACLs are primarily a RADIUS feature for network access control and are not the standard mechanism for defining user roles via TACACS+ device administration attributes.
B. custom access conditions for defining the different roles Conditions are used in policy rules to evaluate a request (the "if" part), not to define the attributes that are sent back as a result (the "then" part).
D. TACACS+ command sets to provide appropriate access Command Sets are used for command authorization (controlling which commands a user can run after logging in), not for sending attributes in the initial Access-Accept response to define the user's shell role. ---

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"TACACS+ Profiles" section.

"A shell profile is a container for a set of authorization attributes that are sent to the NAD when a user is authenticated." This confirms that Shell Profiles are the mechanism for sending attributes upon authentication.

Under the "Task-Attribute-Value (TAV) Pairs" subsection

it states: "You can define custom TACACS attributes and values that are specific to the devices in your network. For example

you can create a custom attribute for a non-Cisco device." This directly supports the use of custom attributes in Shell Profiles for non-Cisco devices.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Configure TACACS+ Command Sets for Device Administration" section.

"Command sets are used for command authorization." This clearly distinguishes the function of Command Sets from Shell Profiles

showing that Command Sets are for post-login command control

not initial role assignment via Access-Accept attributes.