HP Cisco Nexus 5000 Cisco MDS 9000 Family CLI Configuration Guide - Release 4. - Page 780

Role Distributions Chapter 32 Configuring Users and Common Roles Send documentation comments to [email protected] Tip Roles can be used to create VSAN administrators. Depending on the configured rules, these VSAN administrators can configure MDS features (for example, zone, fcdomain, or VSAN properties) for their VSANs without affecting other VSANs. Also, if the role permits operations in multiple VSANs, then the VSAN administrators can change VSAN membership of F or FL ports among these VSANs. Users belonging to roles in which the VSAN policy is set to deny are referred to as VSAN-restricted users. Modifying the VSAN Policy To modify the VSAN policy for an existing role, follow these steps: Step 1 Step 2 Step 3 Step 4 Command Purpose switch# config t Enters configuration mode. switch(config)# role name sangroup switch(config-role)# Places you in role configuration submode for the sangroup role. switch(config)# vsan policy deny switch(config-role-vsan) Changes the VSAN policy of this role to deny and places you in a submode where VSANs can be selectively permitted. switch(config-role)# no vsan policy Deletes the configured VSAN role policy and reverts to deny the factory default (permit). switch(config-role-vsan)# permit vsan Permits this role to perform the allowed commands for 10-30 VSANs 10 through 30. switch(config-role-vsan)# no permit vsan 15-20 Removes the permission for this role to perform commands for VSANs 15 to 20. So, the role is now permitted to perform commands for VSAN 10 to 14, and 21 to 30. Role Distributions Role-based configurations use the Cisco Fabric Services (CFS) infrastructure to enable efficient database management and to provide a single point of configuration for the entire fabric (see Chapter 7, "Using the CFS Infrastructure"). The following configurations are distributed: • Role names and descriptions • List of rules for the roles • VSAN policy and the list of permitted VSANs This section includes the following topics: • About Role Databases, page 32-5 • Locking the Fabric, page 32-5 • Committing Role-Based Configuration Changes, page 32-5 • Discarding Role-Based Configuration Changes, page 32-5 • Enabling Role-Based Configuration Distribution, page 32-6 32-4 Cisco MDS 9000 Family CLI Configuration Guide OL-18084-01, Cisco MDS NX-OS Release 4.x