A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) as a TACACS+ server to authenticate managers on its AOS-CX switches. The company wants CPPM to control which commands managers are allowed to enter. Which service must you add to the managers' TACACS+ enforcement profile?

To control the specific commands a user can execute on a network device via TACACS+, the "Shell" service must be used. When a user attempts to run a command on an AOS-CX switch, the switch sends a TACACS+ authorization request to ClearPass Policy Manager (CPPM). The enforcement profile applied by CPPM must contain the "Shell" service, which includes attributes that either permit or deny specific commands or command sets, thereby enforcing the desired command authorization policy.

A. Cpass:HTTP: This service is used for authorizing web-based access to ClearPass applications like Guest or Onboard, not for CLI command authorization on external network devices.
C. ARAP: AppleTalk Remote Access Protocol (ARAP) is an obsolete remote access protocol and is not relevant to modern TACACS+ based network device administration.
D. Aruba:Common: This is the name of a vendor-specific attribute (VSA) dictionary within ClearPass. It is not a TACACS+ service itself, but rather a container for attributes that might be used within a service.

1. HPE Aruba Networking

ClearPass Policy Manager 6.11 User Guide

Reference: Chapter "OnGuard and NAC Configuration" > Section "Enforcement Profiles" > Subsection "Configuring TACACS+ Enforcement Profiles".

Details: This section describes the process of creating a TACACS+ enforcement profile. It explicitly lists "Shell" as a service that can be added to the profile to control user access and privileges on the network device's command-line interface.

2. HPE Aruba Networking

ArubaOS-CX and ClearPass Integration Guide

Reference: Section "Configuring ClearPass for TACACS+ Device Administration".

Details: This guide provides a step-by-step configuration example for TACACS+ integration. It demonstrates creating an enforcement profile and adding the "Shell" service. Under this service

it shows how to add attributes like priv-lvl for privilege level assignment and how to define command lists to explicitly permit or deny CLI commands

directly addressing the question's requirement.