HP Cisco Nexus 5000 Cisco MDS 9000 Family CLI Configuration Guide - Release 4. - Page 779

Chapter 32 Configuring Users and Common Roles Role-Based Authorization Send documentation comments to [email protected] The rule command specifies operations that can be performed by a specific role. Each rule consists of a rule number, a rule type (permit or deny), a command type (for example, config, clear, show, exec, debug), and an optional feature name (for example, FSPF, zone, VSAN, fcping, or interface). Note In this case, exec commands refer to all commands in the EXEC mode that do not fall in the show, debug, and clear command categories. Modifying Profiles To modify the profile for an existing role, follow these steps: Step 1 Step 2 Step 3 Step 4 Command Purpose switch# config t Enters configuration mode. switch(config)# role name sangroup switch(config-role)# Places you in role configuration submode for the existing role sangroup. switch(config-role)# rule 1 permit config Allows users belonging to the sangroup role to switch(config-role)# rule 2 deny config feature fspf switch(config-role)# rule 3 permit debug feature zone perform all configuration commands except fspf config commands. They can also perform zone debug commands and the fcping EXEC mode command. switch(config-role)# rule 4 permit exec feature fcping switch(config-role)# no rule 4 Deletes rule 4, which no longer permits the sangroup to perform the fcping command. In Step 3, rule 1 is applied first, thus permitting sangroup users access to all config commands. Rule 2 is applied next, denying FSPF configuration to sangroup users. As a result, sangroup users can perform all other config commands, except fspf configuration commands. Note The order of rule placement is important. If you had swapped these two rules and issued the deny config feature fspf rule first and issued the permit config rule next, you would be allowing all sangroup users to perform all configuration commands because the second rule globally overrode the first rule. Configuring the VSAN Policy Configuring the VSAN policy requires the ENTERPRISE_PKG license (see Chapter 3, "Obtaining and Installing Licenses"). You can configure a role so that it only allows tasks to be performed for a selected set of VSANs. By default, the VSAN policy for any role is permit, which allows tasks to be performed for all VSANs. You can configure a role that only allows tasks to be performed for a selected set of VSANs. To selectively allow VSANs for a role, set the VSAN policy to deny, and then set the configuration to permit or the appropriate VSANs. Note Users configured in roles where the VSAN policy is set to deny cannot modify the configuration for E ports. They can only modify the configuration for F or FL ports (depending on whether the configured rules allow such configuration to be made). This is to prevent such users from modifying configurations that may impact the core topology of the fabric. OL-18084-01, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family CLI Configuration Guide 32-3