Cisco Nexus 5000 Series Switch CLI Software Configuration Guide, NX-OS 4.0(1a)N1 (OL-16597-01, January 2009)

Send feedback to [e-mail]
22-8
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01
Chapter 22 Configuring User Accounts and RBAC
Configuring RBAC
You can specify a list of interfaces that the role can access. You can specify it for as many interfaces as
needed:
switch(config-role-interface)# permit interface ethernet 2/1
switch(config-role-interface)# permit interface fc 3/1
switch(config-role-interface)# permit interface vfc 30/1
Changing User Role VLAN Policies
You can change a user role VLAN policy to limit the VLANs that the user can access. To change a user
role VLAN policy, perform this task:
Changing User Role VSAN Policies
You can change a user role VSAN policy to limit the VSANs that the user can access.
To change a user role VSAN policy to limit the VSANs that the user can access, perform this task:
Command Purpose
Step 1
switch# configure terminal
Enters configuration mode.
Step 2
switch(config)# role name role-name
Specifies a user role and enters role configuration
mode.
Step 3
switch(config-role)# rule number permit
command configure terminal ; vlan *
Configures a command rule to allow access to all
VLANs.
Step 4
switch(config-role)# vlan policy deny
Enters role VLAN policy configuration mode.
Step 5
switch(config-role-vlan)# permit vlan
vlan-list
Specifies a range of VLANs that the role can access.
Repeat this command for as many VLANs as needed.
Step 6
switch(config-role-vlan)# exit
Exits role VLAN policy configuration mode.
Step 7
switch(config-role)# show role
(Optional) Displays the role configuration.
Step 8
switch(config-role)# copy running-config
startup-config
(Optional) Copies the running configuration to the
startup configuration.
Command Purpose
Step 1
switch# configure terminal
Enters configuration mode.
Step 2
switch(config-role)# role name role-name
Specifies a user role and enters role configuration
mode.
Step 3
switch(config-role)# rule number permit
command vsan database; vsan *
Configures a command rule to allow access to all
VSANs.
Step 4
switch(config-role)# vsan policy deny
Enters role VSAN policy configuration mode.
Step 5
switch(config-role-vsan)# permit vsan
vsan-list
Specifies a range of VSANs that the role can access.
Repeat this command for as many VSANs as needed.
Step 6
switch(config-role-vsan)# exit
Exits role VSAN policy configuration mode.