01-Fundamentals

HomeSupportResource CenterH3C Access Controllers Command References(E5208P03 E5215P01 R5215P01)-6W10201-Fundamentals
02-RBAC commands
Title Size Download
02-RBAC commands 120.77 KB

RBAC commands

description

Use description to configure a description for a user role for easy identification.

Use undo description to restore the default.

Syntax

description text

undo description

Default

A user role does not have a description.

Views

User role view

Predefined user roles

network-admin

Parameters

text: Configures a user role description, a case-sensitive string of 1 to 128 characters.

Examples

# Configure the description as labVIP for user role role1.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] description labVIP

Related commands

·     display role

·     role

display role

Use display role to display user role information.

Syntax

display role [ name role-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

name role-name: Specifies a user role name, a case-sensitive string of 1 to 63 characters. If you do not specify a user role name, the command displays information about all user roles, including the predefined user roles.

Examples

# Display information about user role 123.

<Sysname> display role name 123

Role: 123

  Description: new role

  VLAN policy: Deny

  Permitted VLANs: 1 to 5, 7 to 8

  Interface policy: Deny

  Permitted interfaces: GigabitEthernet1/0/1 to GigabitEthernet1/0/2, Vlan-interface1 to Vlan-interface20

  VPN instance policy: Deny

  Permitted VPN instances: vpn, vpn1, vpn2

  Location policy: Deny

  Permitted locations: abc 123

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  1       permit RWX   feature-group abc

  2       deny   -W-   feature       ldap

  3       permit       command       system ; radius sc *

  4       permit R--   xml-element   -

  5       permit RW-   oid           1.2.1

  R:Read W:Write X:Execute

# Display information about all user roles.

<Sysname> display role

Role: network-admin

  Description: Predefined network admin role has access to all commands on the

device

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  sys-1   permit       command       *

  sys-2   permit RWX   web-menu      -

  sys-3   permit RWX   xml-element   -

  sys-4   deny         command       display security-logfile summary

  sys-5   deny         command       system-view ; info-center

                                     security-logfile directory *

  sys-6   deny         command       security-logfile save

  sys-7   permit RW-   oid           1

  R:Read W:Write X:Execute

 

Role: network-operator

  Description: Predefined network operator role has access to all read commands

on the device

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  sys-1   permit       command       display *

  sys-2   permit       command       xml

  sys-3   deny         command       display history-command all

  sys-4   deny         command       display exception *

  sys-5   deny         command       display cpu-usage configuration *

  sys-6   deny         command       display kernel exception *

  sys-7   deny         command       display kernel deadloop *

  sys-8   deny         command       display kernel starvation *

  sys-9   deny         command       display kernel reboot *

  sys-12  permit       command       system-view ; local-user *

  sys-13  permit       command       system-view ; switchto *

  sys-14  permit R--   web-menu      -

  sys-15  permit R--   xml-element   -

  sys-16  deny         command       display security-logfile summary

  sys-17  deny         command       system-view ; info-center

                                     security-logfile directory *

  sys-18  deny         command       security-logfile save

  sys-19  deny         command       system-view ; local-user-import *

  sys-20  deny         command       system-view ; local-user-export *

  sys-21  permit R--   oid           1

  R:Read W:Write X:Execute

 

Role: level-0

  Description: Predefined level-0 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  sys-1   permit       command       tracert *

  sys-2   permit       command       telnet *

  sys-3   permit       command       ping *

  sys-4   permit       command       ssh2 *

  sys-5   permit       command       super *

  R:Read W:Write X:Execute

 

Role: level-1

  Description: Predefined level-1 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  sys-1   permit       command       tracert *

  sys-2   permit       command       telnet *

  sys-3   permit       command       ping *

  sys-4   permit       command       ssh2 *

  sys-5   permit       command       display *

  sys-6   permit       command       super *

  sys-7   deny         command       display history-command all

  R:Read W:Write X:Execute

 

Role: level-2

  Description: Predefined level-2 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-3

  Description: Predefined level-3 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-4

  Description: Predefined level-4 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-5

  Description: Predefined level-5 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-6

  Description: Predefined level-6 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-7

  Description: Predefined level-7 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-8

  Description: Predefined level-8 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-9

  Description: Predefined level-9 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  sys-1   permit RWX   feature       -

  sys-2   deny   RWX   feature       device

  sys-3   deny   RWX   feature       filesystem

  sys-4   permit       command       display *

  sys-5   deny         command       display history-command all

  R:Read W:Write X:Execute

 

Role: level-10

  Description: Predefined level-10 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-11

  Description: Predefined level-11 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-12

  Description: Predefined level-12 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-13

  Description: Predefined level-13 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-14

  Description: Predefined level-14 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

 

Role: level-15

  Description: Predefined level-15 role

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  sys-1   permit       command       *

  sys-2   permit RWX   web-menu      -

  sys-3   permit RWX   xml-element   -

  sys-4   deny         command       display security-logfile summary

  sys-5   deny         command       system-view ; info-center

                                     security-logfile directory *

  sys-6   deny         command       security-logfile save

  sys-7   permit RW-   oid           1

  R:Read W:Write X:Execute

 

Role: security-audit

  Description: Predefined security audit role only has access to commands for

the security log administrator

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity

  -------------------------------------------------------------------

  sys-1   deny         command       *

  sys-2   permit       command       display security-logfile summary

  sys-3   permit       command       system-view ; info-center

                                     security-logfile directory *

  sys-4   permit       command       security-logfile save

  sys-5   permit       command       cd *

  sys-6   permit       command       copy *

  sys-7   permit       command       delete *

  sys-8   permit       command       dir *

  sys-9   permit       command       mkdir *

  sys-10  permit       command       more *

  sys-11  permit       command       move *

  sys-12  permit       command       rmdir *

  sys-13  permit       command       pwd

  sys-14  permit       command       rename *

  sys-15  permit       command       undelete *

  sys-16  permit       command       ftp *

  sys-17  permit       command       sftp *

  R:Read W:Write X:Execute

 

Role: guest-manager

  Description: Predefined guest manager role can't access to commands

  VLAN policy: Permit (default)

  Interface policy: Permit (default)

  VPN instance policy: Permit (default)

  Location policy: Permit (default)

  -------------------------------------------------------------------

  Rule    Perm   Type  Scope         Entity                         

  -------------------------------------------------------------------

  sys-1   permit RWX   xml-element   useraccounts/approveguest/     

  sys-2   permit RWX   xml-element   useraccounts/exportguestaccount/

  sys-3   permit RWX   xml-element   useraccounts/generateguestaccount/

  sys-4   permit RWX   xml-element   useraccounts/guest/            

  sys-5   permit RWX   xml-element   useraccounts/guestconfigure/   

  sys-6   permit RWX   xml-element   useraccounts/importguestaccount/

  sys-7   permit RWX   xml-element   useraccounts/exportguesttemplet/

  sys-8   permit RWX   xml-element   rpc/                           

  sys-9   permit RWX   web-menu      m_global/m_networksecurity/

                                     m_guestmanage/m_guestlist/          

  sys-10  permit RWX   web-menu      m_global/m_networksecurity/

                                     m_guestmanage/m_importguest/        

  sys-11  permit RWX   web-menu      m_global/m_networksecurity/

                                     m_guestmanage/m_generateguest/      

  sys-12  permit RWX   web-menu      m_global/m_networksecurity/

                                     m_guestmanage/m_approveguest/       

  sys-13  deny         command       *                               

  R:Read W:Write X:Execute

Table 1 Command output

Field

Description

Role

User role name.

Predefined user role names:

·     network-admin.

·     network-operator.

·     level-n (where n represents an integer in the range of 0 to 15).

·     security-audit.

·     guest-manager.

Description

User role description you have configured for easy identification.

VLAN policy

VLAN policy of the user role:

·     Deny—Denies access to any VLANs except permitted VLANs.

·     Permit (default)—Default VLAN policy, which enables the user role to access all VLANs.

Permitted VLANs

VLANs accessible to the user role.

Interface policy

Interface policy of the user role:

·     DenyDenies access to any interfaces except permitted interfaces.

·     Permit (default)—Default interface policy, which enables the user role to access all interfaces.

Permitted interfaces

Interfaces accessible to the user role.

VPN instance policy

VPN instance policy of the user role:

·     DenyDenies access to any VPNs except permitted VPNs.

·     Permit (default)—Default VPN instance policy, which enables the user role to access all VPN instances.

This field is not supported in the current software version.

Permitted VPN instances

VPNs accessible to the user role.

This field is not supported in the current software version.

Location policy

Location identifier policy of the user role:

·     Deny—Denies access to any location identifiers except for permitted location identifiers.

·     Permit (default)—Default location identifier policy, which enables the user role to access all location identifiers.

Permitted locations

Location identifiers accessible to the user role.

Rule

User role rule number.

A user role rule specifies access permissions for items, including commands, feature-specific commands, Web menus, XML elements, and MIB nodes.

Predefined user role rules are identified by sys-n, where n represents an integer.

Perm

Access control type:

·     permit—User role has access to the specified items.

·     deny—User role does not have access to the specified items.

Type

Controlled type:

·     R—Read-only.

·     W—Write.

·     X—Execute.

Scope

Rule control scope:

·     command—Controls access to the command or commands, as specified in the Entity field.

·     feature—Controls access to the commands of the feature, as specified in the Entity field.

·     feature-group—Controls access to the commands of the features in the feature group, as specified in the Entity field.

·     web-menuControls access to Web menus.

·     xml-elementControls access to XML elements.

·     oidControls access to MIB nodes.

Entity

Command string, feature name, feature group, Web menu, XML element, or OID specified in the user role rule:

·     An en dash (–) represents any feature.

·     An asterisk (*) represents zero or more characters.

 

Related commands

role

display role feature

Use display role feature to display features available in the system.

Syntax

display role feature [ name feature-name | verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

name feature-name: Displays the commands of a feature. The feature-name argument specifies the feature name, and all letters must be in lower case.

verbose: Displays the commands of each feature.

Usage guidelines

If you specify neither the name feature-name option nor the verbose keyword, the command displays only the list of features available in the system.

Examples

 

NOTE:

Support for the features and commands in the following examples depends on the device model.

 

# Display the list of feature names.

<Sysname> display role feature

Feature: device          (Device configuration related commands)

Feature: interface       (Interface related commands)

Feature: syslog          (Syslog related commands)

# Display the commands of each feature.

<Sysname> display role feature verbose

Feature: device          (Device configuration related commands)

  display clock    (R)

  debugging dev    (W)

  display debugging dev    (R)

  display device *    (R)

  display diagnostic-information    (R)

# Display the commands of the aaa feature.

<Sysname> display role feature name aaa

Feature: aaa             (AAA related commands)

  system-view ; domain *    (W)

  system-view ; header *    (W)

  system-view ; aaa *    (W)

  system-view ; ita *    (W)

  display domain *    (R)

  system-view ; user-group *    (W)

  system-view ; local-user *    (W)

  display local-user *    (R)

  display user-group *    (R)

  display debugging local-server    (R)

  debugging local-server *    (W)

  super *    (X)

  display password-control *    (R)

  reset password-control *    (W)

  system-view ; password-control *    (W)

Table 2 Command output (display role feature name aaa)

Field

Description

Feature

Displays the name and brief function description of the feature.

system-view ; domain *

All commands that start with the domain keyword in system view, and all commands in ISP domain view.

system-view ; header *

All commands that start with the header keyword in system view.

system-view ; aaa *

All commands that start with the aaa keyword in system view.

system-view ; ita *

All commands that start with the ita keyword in system view.

display domain *

All commands that start with the display domain keywords in user view.

system-view ; user-group *

All commands that start with the user-group keyword in system view, and all commands in user group view.

system-view ; local-user *

All commands that start with the local-user keyword in system view, and all commands in local user view.

display local-user *

All commands that start with the display local user keywords in user view.

display user-group *

All commands that start with the display user-group keywords in user view.

display debugging local-server

All commands that start with the display debugging local-server keywords in user view.

debugging local-server *

All commands that start with the debugging local-server keywords in user view.

super *

All commands that start with the super keyword in user view.

display password-control *

All commands that start with the display password-control keywords in user view.

reset password-control *

All commands that start with the reset password-control keywords in user view.

system-view ; password-control *

All commands that start with the password-control keyword in system view.

(W)

Command type is Write. A write command configures the system.

(R)

Command type is Read. A read command displays configuration or maintenance information.

(X)

Command type is Execute. An execute command executes a specific function.

 

Related commands

feature

display role feature-group

Use display role feature-group to display feature group information.

Syntax

display role feature-group [ name feature-group-name ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

name feature-group-name: Specifies a feature group. The feature-group-name argument represents the feature group name, a case-sensitive string of 1 to 31 characters. If you do not specify a feature group, the command displays information about all feature groups.

verbose: Displays the commands of each feature in the specified feature group. If you do not specify a feature group, the keyword enables displaying the commands of each feature in every feature group. If you do not specify this keyword, the command displays only the feature lists of feature groups.

Usage guidelines

Feature groups L2 and L3 are predefined feature groups.

Examples

 

NOTE:

Support for the features and commands in the following examples depends on the device model.

 

# Display the feature lists of feature groups.

<Sysname> display role feature-group

Feature group: L2

Feature: igmp-snooping   (IGMP-Snooping related commands)

Feature: mld-snooping    (MLD-Snooping related commands)

Feature: lacp            (LACP related commands)

Feature: stp             (STP related commands)

Feature: lldp            (LLDP related commands)

Feature: loopbk-detect   (Loopback-detection related commands)

Feature: vlan            (Virtual LAN related commands)

Feature: evi             (EVI related commands)

Feature: ofp             (OFP related commands)

Feature: port-security   (Port-security related commands)

 

Feature group: L3

Feature: route           (Route management related commands)

Feature: usr             (Unicast static route related commands)

Feature: l3vpn           (Layer 3 Virtual Private Network related commands)

Feature: multicast       (Multicast related commands)

# Display the commands in each feature group. For more information about the wildcards and marks used in the command list, see Table 2.

<Sysname> display role feature-group verbose

Feature group: L2

Feature: igmp-snooping   (IGMP-Snooping related commands)

  system-view ; igmp-snooping *    (W)

  system-view ; vlan * ; igmp-snooping *    (W)

  system-view ; vlan * ; pim-snooping *    (W)

  system-view ; interface * ; igmp-snooping *    (W)

  display igmp-snooping *    (R)

  display pim-snooping *    (R)

  display l2-multicast *    (R)

  system-view ; probe ; display system internal l2-multicast *    (R)

  reset igmp-snooping *    (W)

  reset pim-snooping *    (W)

  reset l2-multicast *    (W)

  debugging igmp-snooping *    (W)

  display debugging igmp-snooping *    (R)

  system-view ; probe ; debugging system internal igmp-snooping *    (W)

Feature: mld-snooping    (MLD-Snooping related commands)

  system-view ; mld-snooping *    (W)

  system-view ; vlan * ; mld-snooping *    (W)

  system-view ; vlan * ; ipv6 pim-snooping *    (W)

  system-view ; interface * ; mld-snooping *    (W)

  display mld-snooping *    (R)

  display ipv6 pim-snooping *    (R)

  display ipv6 l2-multicast *    (R)

  system-view ; probe ; display system internal ipv6 l2-multicast *    (R)

  reset mld-snooping *    (W)

  reset ipv6 pim-snooping *    (W)

  reset ipv6 l2-multicast *    (W)

  debugging mld-snooping *    (W)

  display debugging mld-snooping *    (R)

  system-view ; probe ; debugging system internal mld-snooping *    (W)

# Display the feature list of the L3 feature group.

<Sysname> display role feature-group name L3

Feature group: L3

Feature: route           (Route management related commands)

Feature: usr             (Unicast static route related commands)

Feature: l3vpn           (Layer 3 Virtual Private Network related commands)

Feature: multicast       (Multicast related commands)

Related commands

·     feature

·     role feature-group

feature

Use feature to add a feature to a feature group.

Use undo feature to remove a feature from a feature group.

Syntax

feature feature-name

undo feature feature-name

Default

A user-defined feature group does not have any features.

Views

Feature group view

Predefined user roles

network-admin

Parameters

feature-name: Specifies a feature name. You must enter the feature name exactly as the feature name is displayed, including the case.

Usage guidelines

Repeat the feature command to add multiple features to a feature group.

Examples

# Add the AAA and ACL features to feature group security-features.

<Sysname> system-view

[Sysname] role feature-group name security-features

[Sysname-featuregrp-security-features] feature aaa

[Sysname-featuregrp-security-features] feature acl

Related commands

·     display role feature

·     display role feature-group

·     role feature-group

interface policy deny

Use interface policy deny to enter user role interface policy view.

Use undo interface policy deny to restore the default user role interface policy.

Syntax

interface policy deny

undo interface policy deny

Default

A user role has access to all interfaces.

Views

User role view

Predefined user roles

network-admin

Usage guidelines

To restrict the interface access of a user role to a set of interfaces, perform the following tasks:

1.     Use interface policy deny to enter user role interface policy view.

2.     Use permit interface to specify accessible interfaces.

 

 

NOTE:

The interface policy deny command denies the access of the user role to any interfaces if the permit interface command is not configured.

 

To configure an interface, make sure the interface is permitted by the user role interface policy in use. You can perform the following tasks on an accessible interface:

·     Create, remove, or configure the interface.

·     Enter the interface view.

·     Specify the interface in feature commands.

The create and remove operations are available only for logical interfaces.

Any change to a user role interface policy takes effect only on users who log in with the user role after the change.

Examples

# Enter user role interface policy view of role1, and deny role1 to access any interfaces.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] interface policy deny

[Sysname-role-role1-ifpolicy] quit

# Enter user role interface policy view of role1, and deny role1 to access any interfaces except for GigabitEthernet 1/0/1 through GigabitEthernet 1/0/5.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] interface policy deny

[Sysname-role-role1-ifpolicy] permit interface gigabitethernet 1/0/1 to gigabitethernet 1/0/5

Related commands

·     display role

·     permit interface

·     role

location policy deny

Use location policy deny to enter user role location identifier policy view.

Use undo location policy deny to restore the default.

Syntax

location policy deny

undo location policy deny

Default

A user role has access to all location identifiers.

Views

User role view

Predefined user roles

network-admin

Usage guidelines

To restrict the location identifier access of a user role to a set of location identifiers, perform the following tasks:

1.     Use location policy deny to enter user role location identifier policy view.

2.     Use permit location to specify accessible location identifiers.

 

 

NOTE:

The location policy deny command denies the access of the user role to any location identifiers if the permit location command is not configured.

 

To configure a location identifier, make sure the location identifier is permitted by the user role location identifier policy in use. You can perform the following tasks on an accessible location identifier:

·     Create, remove, or configure the location identifier.

·     Enter the location identifier view.

·     Specify the location identifier in feature commands.

Any change to a user role location identifier policy takes effect only on users who log in with the user role after the change.

Examples

# Enter user role location identifier policy view of role1, and deny role1 to access any location identifiers.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] location policy deny

[Sysname-role-role1-locationpolicy] quit

# Enter user role location identifier policy view of role1, and deny role1 to access any location identifiers except for abc and 123.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] location policy deny

[Sysname-role-role1-locationpolicy] permit location abc 123

Related commands

·     display role

·     permit location

·     role

permit interface

Use permit interface to configure a list of interfaces accessible to a user role.

Use undo permit interface to disable the access of a user role to specific interfaces.

Syntax

permit interface interface-list

undo permit interface [ interface-list ]

Default

No permitted interfaces are configured in user role interface policy view.

Views

User role interface policy view

Predefined user roles

network-admin

Parameters

interface-list: Specifies a space-separated list of up to 10 interface items. Each interface item specifies one interface in the interface-type interface-number form or a range of interfaces in the interface-type interface-number to interface-type interface-number form. If you specify an interface range, the end interface must meet the following requirements:

·     Be the same type as the start interface.

·     Have a higher interface number than the start interface.

Usage guidelines

To permit a user role to access an interface after you configure the interface policy deny command, you must add the interface to the permitted interface list of the policy. With the user role, you can perform the following tasks to the interfaces in the permitted interface list:

·     Create, remove, or configure the interfaces.

·     Enter the interface views.

·     Specify the interfaces in feature commands.

The create and remove operations are available only for logical interfaces.

You can repeat the permit interface command to add permitted interfaces to a user role interface policy.

The undo permit interface command removes the entire list of permitted interfaces if you do not specify an interface.

Any change to a user role interface policy takes effect only on users who log in with the user role after the change.

Examples

1.     Configure user role role1:

# Permit the user role role1 to execute all commands available in interface view and VLAN view.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] rule 1 permit command system-view ; interface *

[Sysname-role-role1] rule 2 permit command system-view ; vlan *

# Permit the user role to access VLAN-interface 1, and VLAN-interface 5 to VLAN-interface 7.

[Sysname-role-role1] interface policy deny

[Sysname-role-role1-ifpolicy] permit interface vlan-interface 1 vlan-interface 5 to vlan-interface 7

[Sysname-role-role1-ifpolicy] quit

[Sysname-role-role1] quit

2.     Verify that you cannot use the user role to work on any interfaces except VLAN-interface 1 and VLAN-interface 5 to VLAN-interface 7:

# Verify that you can enter VLAN-interface 1 interface view.

[Sysname] interface interface vlan-interface 1

[Sysname-Vlan-interface1] quit

# Verify that you cannot enter VLAN-interface 2 interface view.

[Sysname] interface vlan-interface 2

Permission denied.

Related commands

·     display role

·     interface policy deny

·     role

permit location

Use permit location to configure a list of location identifiers accessible to a user role.

Use undo permit location to disable the access of a user role to specific location identifiers.

Syntax

permit location location-name&<1-10>

undo permit location [ location-name&<1-10> ]

Default

No permitted location identifiers are configured in user role location identifier policy view.

Views

User role location identifier policy view

Predefined user roles

network-admin

Parameters

location-name&<1-10>: Specifies a space-separated list of up to 10 location identifier names. Each name is a case-sensitive string of 1 to 31 characters.

Usage guidelines

To permit a user role to access a location identifier after you configure the location policy deny command, you must add the location identifier to the permitted location identifier list of the policy. With the user role, you can perform the following tasks to the location identifiers in the permitted location identifier list:

·     Create, remove, or configure the location identifiers.

·     Enter the location identifier views.

·     Specify the location identifiers in feature commands.

You can repeat the permit location command to add multiple permitted location identifiers to a user role location identifier policy.

The undo permit location command removes the entire list of permitted location identifiers if you do not specify a location identifier.

Any change to a user role location identifier policy takes effect only on users who log in with the user role after the change.

Examples

1.     Configure user role role1:

# Permit user role role1 to execute all commands available in system view and in the child views of system view.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] rule 1 permit command system-view ; *

# Permit the user role to access location identifiers abc and 123.

[Sysname-role-role1] location policy deny

[Sysname-role-role1-locationpolicy] permit location abc 123

[Sysname-role-role1-locationpolicy] quit

[Sysname-role-role1] quit

2.     Verify that you cannot use the user role to work on any location identifiers except for location identifiers abc and 123:

# Verify that you can create location identifier abc and specify the location identifier for AP group ap-group1.

[Sysname] wlan location abc

[Sysname] wlan ap-group 1

[Sysname-wlan-ap-group-1] location abc

[Sysname-wlan-ap-group-1] quit

# Verify that you cannot create location identifier local or specify the location identifier for AP group ap-group1.

[Sysname] wlan location local

Permission denied.

[Sysname] wlan ap-group 1

[Sysname-wlan-ap-group-1] location local

Permission denied.

Related commands

·     display role

·     location policy deny

·     role

permit vlan

Use permit vlan to configure a list of VLANs accessible to a user role.

Use undo permit vlan to remove the permission for a user role to access specific VLANs.

Syntax

permit vlan vlan-id-list

undo permit vlan [ vlan-id-list ]

Default

No permitted VLANs are configured in user role VLAN policy view.

Views

User role VLAN policy view

Predefined user roles

network-admin

Parameters

vlan-id-list: Specifies a space-separated list of up to 10 VLAN items. Each VLAN item specifies a VLAN by VLAN ID or specifies a range of VLANs in the form of vlan-id1 to vlan-id2. The value range for the VLAN IDs is 1 to 4094. If you specify a VLAN range, the value for the vlan-id2 argument must be greater than the value for the vlan-id1 argument.

Usage guidelines

To permit a user role to access a VLAN after you configure the vlan policy deny command, you must add the VLAN to the permitted VLAN list of the policy. With the user role, you can perform the following tasks on the VLANs in the permitted VLAN list:

·     Create, remove, or configure the VLANs.

·     Enter the VLAN views.

·     Specify the VLANs in feature commands.

You can repeat the permit vlan command to add multiple permitted VLANs to a user role VLAN policy.

The undo permit vlan command removes the entire list of permitted VLANs if you do not specify a VLAN.

Any change to a user role VLAN policy takes effect only on users who log in with the user role after the change.

Examples

1.     Configure user role role1:

# Permit the user role role1 to execute all commands available in interface view and VLAN view.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] rule 1 permit command system-view ; interface *

[Sysname-role-role1] rule 2 permit command system-view ; vlan *

# Permit the user role role1 to access VLANs 2, 4, and 50 to 100.

[Sysname-role-role1] vlan policy deny

[Sysname-role-role1-vlanpolicy] permit vlan 2 4 50 to 100

[Sysname-role-role1-vlanpolicy] quit

[Sysname-role-role1] quit

2.     Verify that you cannot use the user role to work on any VLANs except VLANs 2, 4, and 50 to 100:

# Verify that you can create VLAN 100 and enter the VLAN view.

[Sysname] vlan 100

[Sysname-vlan100] quit

# Verify that you can add port GigabitEthernet 1/0/1 to VLAN 100 as an access port.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] port access vlan 100

[Sysname-GigabitEthernet1/0/1] quit

# Verify that you cannot create VLAN 101 or enter the VLAN view.

[Sysname] vlan 101

Permission denied.

Related commands

·     display role

·     role

·     vlan policy deny

role

Use role to create a user role and enter its view, or enter the view of an existing user role.

Use undo role to delete a user role.

Syntax

role name role-name

undo role name role-name

Default

The system has the following predefined user roles: network-admin, network-operator, level-n (where n represents an integer in the range of 0 to 15), security-audit, and guest-manager.

Views

System view

Predefined user roles

network-admin

Parameters

name role-name: Specifies a username. The role-name argument is a case-sensitive string of 1 to 63 characters.

Usage guidelines

You can create a maximum of 64 user roles in addition to the predefined user roles.

To change the permissions assigned to a user role, you must first enter the user role view.

You cannot delete the predefined user roles or change the permissions assigned to network-admin, network-operator, level-15, security-audit, or guest-manager.

You cannot assign the security-audit user role to non-AAA authentication users.

The access permissions of the level-0 to level-14 user roles can be modified through user role rules and resource access policies. However, you cannot make changes on the predefined access permissions of these user roles. For example, you cannot change the access permission of these user roles to the display history-command all command.

Examples

# Create the user role role1 and enter the user role view.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1]

Related commands

·     display role

·     interface policy deny

·     rule

·     vlan policy deny

role default-role enable

Use role default-role enable to enable the default user role feature for remote AAA users.

Use undo role default-role enable to restore the default.

Syntax

role default-role enable [ role-name ]

undo role default-role enable

Default

The default user role feature is disabled. AAA users who do not have a user role cannot log in to the device.

Views

System view

Predefined user roles

network-admin

Parameters

role-name: Specifies a user role by its name for the default user role. The user role must already exist. The argument is a case-sensitive string of 1 to 63 characters. If you do not specify a user role, the default user role is network-operator.

Usage guidelines

The default user role feature assigns the default user role to AAA-authenticated users if the authentication server does not assign any user roles to the users. These users are allowed to access the system with the default user role.

If AAA users have been assigned user roles, they log in with the user roles.

Examples

# Enable the default user role feature.

<Sysname> system-view

[Sysname] role default-role enable

Related commands

role

role feature-group

Use role feature-group to create a user role feature group and enter its view, or enter the view of an existing user role feature group.

Use undo role feature-group to delete a user role feature group.

Syntax

role feature-group name feature-group-name

undo role feature-group name feature-group-name

Default

Two user role feature groups, L2 and L3, are created.

Views

System view

Predefined user roles

network-admin

Parameters

name feature-group-name: Specifies a feature group name. The feature-group-name argument is a case-sensitive string of 1 to 31 characters.

Usage guidelines

The L2 feature group includes all Layer 2 feature commands, and the L3 feature group includes all Layer 3 feature commands. These predefined feature groups are not user configurable.

In addition to the predefined feature groups L2 and L3, you can create a maximum of 64 user role feature groups.

After you create a user role feature group, you can use the display role feature command to display the features available in the system. Then you can use the feature command to add features to the feature group.

Examples

# Create a feature group named security-features and enter its view.

<Sysname> system-view

[Sysname] role feature-group name security-features

[Sysname-featuregrp-security-features]

Related commands

·     display role feature-group

·     display role feature

·     feature

rule

Use rule to create or change a user role rule for controlling command, Web menu, XML element, or MIB node access.

Use undo rule to delete a user role rule.

Syntax

rule number { deny | permit } { command command-string | { execute | read | write } * { feature [ feature-name ] | feature-group feature-group-name | oid oid-string | web-menu [ web-string ] | xml-element [ xml-string ] } }

undo rule { number | all }

Default

A user-defined user role does not have any rules and cannot access any commands, Web menus, XML elements, or MIB nodes.

Views

User role view

Predefined user roles

network-admin

Parameters

number: Specifies a rule number in the range of 1 to 256.

deny: Denies access to the specified commands, Web menus, XML elements, or MIB nodes.

permit: Permits access to the specified commands, Web menus, XML elements, or MIB nodes.

command command-string: Specifies a command string. The command-string argument is a case-sensitive string of 1 to 128 characters, including the following characters:

·     The wildcard asterisk (*).

·     The delimiters space and tab.

·     All printable characters.

execute: Specifies the execute commands, Web menus, XML elements, or MIB nodes. An execute command (for example, ping), Web menu, XML element, or MIB node executes a specific function or program.

read: Specifies the read commands, Web menus, XML elements, or MIB nodes. A read command (for example, display, dir, more, or pwd), Web menu, XML element, or MIB node displays configuration or maintenance information.

write: Specifies the write commands, Web menus, XML elements, or MIB nodes. A write command (for example, ssh server enable), Web menu, XML element, or MIB node configures the system.

feature [ feature-name ]: Specifies one or all features. The feature-name argument specifies a feature name. If you do not specify a feature name, you specify all the features in the system. When you specify a feature, the feature name must be the same, including the case, as the name displayed by the display role feature command.

feature-group feature-group-name: Specifies a user-defined or predefined feature group. The feature-group-name argument represents the feature group name, a case-sensitive string of 1 to 31 characters. If the feature group has not been created, the rule takes effect after the group is created. To display the feature groups that have been created, use the display role feature-group command.

oid oid-string: Specifies an OID of a MIB node. The oid-string argument represents the OID, a case-insensitive string of 1 to 255 characters. The OID is a dotted numeric string that uniquely identifies the path from the root node to this node. For example, 1.3.6.1.4.1.25506.8.35.14.19.1.1.

web-menu [ web-string ]: Specifies a Web menu. The web-string argument represents the ID path of the Web menu, a case-insensitive string of 1 to 255 characters. Use the forward slash (/) to separate ID items, for example, M_DEVICE/I_BASIC_INFO/I_reboot. If you do not specify a Web menu, the rule applies to all Web items. To verify the ID path of a Web menu, use the display web menu command.

xml-element [ xml-string ]: Specifies an XML element. The xml-string argument represents the XPath of the XML element, a case-insensitive string of 1 to 255 characters. Use the forward slash (/) to separate Xpath items, for example, Interfaces/Index/Name. If you do not specify an XML element, the rule applies to all XML elements.

all: Deletes all the user role rules.

Usage guidelines

You can define the following types of rules for different access control granularities:

·     Command rule—Controls access to a command or a set of commands that match a regular expression.

·     Feature rule—Controls access to the commands of a feature by command type.

·     Feature group ruleControls access to the commands of a group of features by command type.

·     Web menu rule—Controls access to Web menus by menu type.

·     XML element rule—Controls access to XML elements by element type.

·     OID rule—Controls access to the specified MIB node and its child nodes by node type.

A user role can access the set of permitted commands, Web menus, XML elements, and MIB nodes specified in the user role rules. User role rules include predefined (identified by sys-n) and user-defined user role rules.

You can configure a maximum of 256 user-defined rules for a user role. The total number of user-defined user role rules cannot exceed 1024.

Access to the file system commands is controlled by both the file system command rules and the file system feature rule.

A command with output redirection to the file system is permitted only when the command type write is assigned to the file system feature.

Any rule modification, addition, or removal for a user role takes effect only on the users who log in with the user role after the change.

The following guidelines apply to non-OID rules:

·     If two user-defined rules of the same type conflict, the rule with the higher ID takes effect. For example, a user role can use the tracert command but not the ping command if the user role contains rules configured by using the following commands:

¡     rule 1 permit command ping

¡     rule 2 permit command tracert

¡     rule 3 deny command ping

·     If a predefined user role rule and a user-defined user role rule conflict, the user-defined user role rule takes effect.

The following guidelines apply to OID rules:

·     The system compares an OID with the OIDs specified in rules, and it uses the longest match principle to select a rule for the OID. For example, a user role cannot access the MIB node with OID 1.3.6.1.4.1.25506.141.3.0.1 if the user role contains rules configured by using the following commands:

¡     rule 1 permit read write oid 1.3.6

¡     rule 2 deny read write oid 1.3.6.1.4.1

¡     rule 3 permit read write oid 1.3.6.1.4

·     If the same OID is specified in multiple rules, the rule with the higher ID takes effect. For example, a user role can access the MIB node with OID 1.3.6.1.4.1.25506.141.3.0.1 if the user role contains rules configured by using the following commands:

¡     rule 1 permit read write oid 1.3.6

¡     rule 2 deny read write oid 1.3.6.1.4.1

¡     rule 3 permit read write oid 1.3.6.1.4.1

When you specify a command string, follow the guidelines in Table 3.

Table 3 Command string configuration rules

Rule

Guidelines

Semicolon (;) is the delimiter.

Use a semicolon to separate the command of each view that you must enter before you access a command or a set of commands. However, do not use a semicolon to separate commands available in user view or any view, for example, display and dir.

Each semicolon-separated segment must have a minimum of one printable character.

To specify the commands in a view but not the commands in the view's subviews, use a semicolon as the last printable character in the last segment. To specify the commands in a view and the view's subviews, the last printable character in the last segment must not be a semicolon.

For example, you must enter system view before you enter interface view. To specify all commands starting with the ip keyword in any interface view, you must use the "system ; interface * ; ip * ;" command string.

For another example, the "system ; radius scheme * ;" command string represents all commands that start with the radius scheme keywords in system view. The "system ; radius scheme *" command string represents all commands that start with the radius scheme keywords in system view and all commands in RADIUS scheme view.

Asterisk (*) is the wildcard.

An asterisk represents zero or multiple characters.

In a non-last segment, you can use an asterisk only at the end of the segment.

In the last segment, you can use an asterisk in any position of the segment. If the asterisk appears at the beginning, you cannot specify a printable character behind the asterisk.

For example, the "system ; *" command string represents all commands available in system view and all subviews of the system view. The "debugging * event" command string represents all event debugging commands available in user view.

Keyword abbreviation is allowed.

You can specify a keyword by entering the first few characters of the keyword. Any command that starts with this character string matches the rule.

For example, " rule 1 deny command dis ip routing-table" denies access to the display ip routing-table summary and display ip routing-table verbose commands.

To control the access to a command, you must specify the command immediately after the view that has the command.

To control access to a command, you must specify the command immediately behind the view to which the command is assigned. The rules that control command access for any subview do not apply to the command.

For example, the "rule 1 deny command system ; interface * ; *" command string disables access to any command that is assigned to interface view. However, you can still execute the acl number command in interface view, because this command is assigned to system view rather than interface view. To disable access to this command, use "rule 1 deny command system ; acl *;".

Do not include the vertical bar (|), greater-than sign (>), or double greater-than sign (>>) when you specify display commands in a user role command rule.

The system does not treat the redirect signs and the parameters that follow the signs as part of command lines. However, in user role command rules, these redirect signs and parameters are handled as part of command lines. As a result, no rule that includes any of these signs can find a match.

For example, "rule 1 permit command display debugging > log" can never find a match. This is because the system has a display debugging command but not a display debugging > log command.

 

Examples

# Permit the user role role1 to execute the display acl command.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] rule 1 permit command display acl

# Permit the user role role1 to execute all commands that start with the display keyword.

[Sysname-role-role1] rule 2 permit command display *

# Permit the user role role1 to execute the radius scheme aaa command in system view and use all commands assigned to RADIUS scheme view.

[Sysname-role-role1] rule 3 permit command system ; radius scheme aaa

# Deny the access of role1 to any read or write commands of any features.

[Sysname-role-role1] rule 4 deny read write feature

# Deny the access of role1 to any read commands of the aaa feature.

[Sysname-role-role1] rule 5 deny read feature aaa

# Permit role1 to access all read, write, and execute commands of the feature group security-features.

[Sysname-role-role1] rule 6 permit read write execute feature-group security-features

# Permit role1 to access all read and write MIB nodes starting from the node with OID 1.1.2.

[Sysname-role-role1] rule 7 permit read write oid 1.1.2

Related commands

·     display role

·     display role feature

·     display role feature-group

·     display web menu

·     role

super

Use super to obtain another user role without reconnecting to the device.

Syntax

super [ role-name ]

Views

User view

Predefined user roles

network-admin

Parameters

role-name: Specifies a user role, a case-sensitive string of 1 to 63 characters. The user role must exist in the system, and it cannot be security-audit or guest-manager. If you do not specify a user role, you obtain the default target user role.

Usage guidelines

The obtained user role is a temporary user role, because this command is effective only on the current login. The next time you are logged in with the user account, the original user role settings take effect.

To enable a user to obtain another user role without reconnecting to the device, you must configure user role authentication.

·     If no local password is configured in the local password authentication (local), a console user can obtain the user role by either entering a string or not entering anything.

·     If no local password is configured in the local-then-remote authentication (local scheme), a console or VTY user performs remote authentication.

Examples

# Obtain the user role network-operator.

<Sysname> super network-operator

Password:

User privilege role is network-operator, and only those commands that authorized to the role can be used.

Related commands

·     authentication super (Security Command Reference)

·     super authentication-mode

·     super password

super authentication-mode

Use super authentication-mode to set an authentication mode for temporary user role authorization.

Use undo super authentication-mode to restore the default.

Syntax

super authentication-mode { local | scheme } *

undo super authentication-mode

Default

Local password authentication applies.

Views

System view

Predefined user roles

network-admin

Parameters

local: Enables local password authentication.

scheme: Enables remote AAA authentication.

Usage guidelines

For local password authentication, use the super password command to set a password.

For remote AAA authentication, set the username and password on the RADIUS or HWTACACS server.

If you specify both local and scheme keywords, the keyword first entered in the command takes precedence.

·     scheme local—Enables remote-then-local authentication mode. The device first performs AAA authentication to obtain a temporary user role. Local password authentication is performed if the remote HWTACACS or RADIUS server does not respond, or if the AAA configuration on the device is invalid.

·     local scheme—Enables local-then-remote authentication mode. The device first performs local password authentication. If no password is configured for the user role, the device performs remote authentication for console and VTY users.

For more information about AAA, see Security Configuration Guide.

Examples

# Enable local-only authentication for temporary user role authorization.

<Sysname> system-view

[Sysname] super authentication-mode local

# Enable remote-then-local authentication for temporary user role authorization.

<Sysname> system-view

[Sysname] super authentication-mode scheme local

Related commands

·     authentication super (Security Command Reference)

·     super password

super default role

Use super default role to specify the default target user role for temporary user role authorization.

Use undo super default role to restore the default.

Syntax

super default role role-name

undo super default role

Default

The default target user role is network-admin.

Views

System view

Predefined user roles

network-admin

Parameters

role-name: Specifies the name of the default target user role, a case-sensitive string of 1 to 63 characters. The user role must exist in the system, and it cannot be security-audit or guest-manager.

Usage guidelines

The default target user role is applied to the super or super password command when you do not specify a user role for the command.

Examples

# Specify the default target user role as network-operator for temporary user role authorization.

<Sysname> system-view

[Sysname] super default role network-operator

Related commands

·     super

·     super password

super password

Use super password to set a password for a user role.

Use undo super password to delete the password for a user role.

Syntax

super password [ role role-name ] [ { hash | simple } string ]

undo super password [ role role-name ]

Default

No password is set for a user role.

Views

System view

Predefined user roles

network-admin

Parameters

role role-name: Specifies a user role, a case-sensitive string of 1 to 63 characters. The user role must exist in the system, and it cannot be security-audit or guest-manager. If you do not specify a user role, the command sets a password for the default target user role.

hash: Sets a hashed password.

simple: Sets a plaintext password. For security purposes, the password specified in plaintext form will be stored in hashed form.

string: Specifies the password string. This argument is case sensitive.

·     If the simple keyword is specified, the password must be a string of 1 to 63 characters.

·     If the hash keyword is specified, the password must be a string of 1 to 110 characters.

Usage guidelines

If you do not specify either the hash keyword or the simple keyword, you specify a plaintext password in the interactive mode.

Set a password if you configure local password authentication for temporary user role authorization.

It is a good practice to specify different passwords for different user roles.

Examples

# Set the password to 123456TESTplat&! for the user role network-operator.

<Sysname> system-view

[Sysname] super password role network-operator simple 123456TESTplat&!

# Set the password to 123456TESTplat&! in the interactive mode for the user role network-operator.

<Sysname> system-view

[Sysname] super password role network-operator

Password:

Confirm :

Updating user information. Please wait... ...

Related commands

·     super authentication-mode

·     super default role

vlan policy deny

Use vlan policy deny to enter user role VLAN policy view.

Use undo vlan policy deny to restore the default user role VLAN policy.

Syntax

vlan policy deny

undo vlan policy deny

Default

A user role has access to all VLANs.

Views

User role view

Predefined user roles

network-admin

Usage guidelines

To restrict the VLAN access of a user role to a set of VLANs, perform the following tasks:

1.     Use vlan policy deny to enter user role VLAN policy view.

2.     Use permit vlan to specify accessible VLANs.

 

 

NOTE:

The vlan policy deny command denies the access of the user role to any VLANs if the permit vlan command is not configured.

 

To configure a VLAN, make sure the VLAN is permitted by the user role VLAN policy in use. You can perform the following tasks on an accessible VLAN:

·     Create, remove, or configure the VLAN.

·     Enter the VLAN view.

·     Specify the VLAN in feature commands.

Any change to a user role VLAN policy takes effect only on users who log in with the user role after the change.

Examples

# Enter user role VLAN policy view of role1, and deny the access of role1 to any VLANs.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] vlan policy deny

[Sysname-role-role1-vlanpolicy] quit

# Enter user role VLAN policy view of role1, and deny the access of role1 to any VLANs except VLANs 50 to 100.

<Sysname> system-view

[Sysname] role name role1

[Sysname-role-role1] vlan policy deny

[Sysname-role-role1-vlanpolicy] permit vlan 50 to 100

Related commands

·     display role

·     permit vlan

·     role