Is it ever possible to delegate control over a single switch's port to an end user? Here's the situation: let's say a company offers colocation service. Each client's server is connected so a port on a switch. If an user wants to create some rules for this port (for example disable access from specific IP addresses), he has to contact tech support. Are there any ways of delegating user's port (and only this port!) to the user?
Absolutely. In the TACACS configuration, you can restrict the commands you allow, but you would do better to move that logic into a web application, rather than give your customers direct access into the switches. Simply put, you can create very granular access control using TACACS, but it is very easy to screw-up, and keeping the user-> device -> port -> commands mappings correct in TACACS is harder than keeping it correct in a database-driven application.