Email: evarainbow@evarainbow.com

NX-OS User Roles and Rules – Cisco Network Security

User roles contain rules that define the operations allowed for the user who is assigned the role. Each user role can contain multiple rules, and each user can have multiple roles. For example, if role1 allows access only to configuration operations, and role2 allows access only to debug operations, users who belong to both role1 and role2 can access configuration and debug operations. You can also limit access to specific Virtual Routing and Forwarding (VRF) instances, VLANs, and interfaces.

The Cisco NX-OS software provides the following user roles:

network-admin: Complete read-and-write access to the entire Cisco NX-OS device (for Nexus 7000, only available in the default VDC)

network-operator: Complete read access to the entire Cisco NX-OS device (for Nexus 7000, only available in the default VDC)

vdc-admin: Read-and-write access limited to a VDC

vdc-operator: Read access limited to a VDC

Note

Only Cisco Nexus 7000 Series switches support multiple VDCs; however, the vdc-operator role is available on all Nexus switches and has the same privileges and limitations as the network-operator role.

Note

All Cisco Nexus Series switches except Nexus 7000 support a single VDC; consequently the vdc-admin has the same privileges and limitations as the network-admin.

By default, the user accounts without an administrator role can access only the show, exit, end, and configure terminal commands. You can add rules to allow users to configure features.

Note

If you belong to multiple roles, you can execute a combination of all the commands permitted by these roles. Access to a command takes priority over being denied access to a command. For example, suppose a user has role1, which is denied access to the configuration commands. However, the user also has role2, which has access to the configuration commands. In this case, the user has access to the configuration commands.

Note

Only the network-admin user can perform a checkpoint or rollback in the RBAC roles. Though other users have these commands as a permit rule in their role, user access is denied when you try to execute these commands.

The rule is the basic element of a role. A rule defines what operations the role allows the user to perform. You can apply rules for the following parameters:

Command: A command or group of commands defined in a regular expression

 Feature: A command or group of commands defined in a regular expression

Feature group: Default or user-defined group of features

OID: An SNMP object identifier (OID)

The command, feature, and feature group parameters create a hierarchical relationship. The most basic control parameter is the command. The next control parameter is the feature, which represents all commands associated with the feature. The last control parameter is the feature group. The feature group combines related features and allows you to easily manage the rules. The Cisco NX-OS software also supports the predefined feature group L3 that you can use.

You can configure up to 256 rules for each role. The user-specified rule number determines the order in which the rules are applied. Rules are applied in descending order. For example, if a role has three rules, rule 3 is applied before rule 2, which is applied before rule 1.

For Nexus 7000 with virtual device context, the users with the network-admin and network-operator roles can operate in all VDCs when logged in from the default VDC and use the 805switchto vdc command to access other VDCs. All other user roles are local to the VDC. Roles are not shared between VDCs. Each VDC maintains an independent user role database.

Leave a Reply

Your email address will not be published. Required fields are marked *