A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) as a TACACS+ server to authenticate managers on its AOS-CX switches. The company wants CPPM to control which commands managers are allowed to enter. You see there is no field to enter these commands in ClearPass. How do you start configuring the command list on CPPM?

In HPE Aruba Networking ClearPass Policy Manager (CPPM), TACACS+ command authorization for network devices is configured within a TACACS+ Enforcement Profile. By default, the attributes for command authorization are not visible. To expose these attributes and begin configuring a command list, you must first add the "Shell" service to the profile. The Shell service is the TACACS+ component specifically responsible for command authorization, and adding it enables the configuration of attributes like shell:cmd to permit or deny specific commands and arguments.

B. Edit the TACACS+ settings in the AOS-CX switches' network device entries. Network device entries in CPPM are for defining the device's identity (IP/hostname) and the shared secret for TACACS+ communication, not for command authorization rules.
C. Create an enforcement policy with the TACACS+ type. An enforcement policy is used to apply an enforcement profile based on conditions (e.g., user role). The command list itself is configured in the profile, not the policy.
D. Edit the settings for CPPM's default TACACS+ admin roles. CPPM admin roles define permissions for accessing the ClearPass administrative interface itself, not for managing command execution on external network devices like switches.

1. HPE Aruba Networking

ClearPass Policy Manager 6.11 User Guide

Page 688

"Configuring TACACS+ Enforcement Profiles": "To configure command authorization for a user

you must select the Shell service from the Services drop-down list. When you select the Shell service

the Attributes tab is populated with the attributes supported for that service." This document explicitly states that adding the Shell service is the required step to access command authorization attributes.

2. HPE Aruba Networking

ArubaOS-CX and ClearPass Integration Guide

(Version for AOS-CX 10.04

ClearPass 6.8)

Page 25

Section "Configure ClearPass for management access"

Step 5 "Create an Enforcement Profile": The guide illustrates the process

showing that within the Enforcement Profile configuration

the "Services" tab is used to "Add Service" and select "Shell". Following this step

the guide proceeds to configure command-specific attributes under the "Attributes" tab. This confirms that adding the Shell service is the prerequisite for configuring the command list.