R211x-HP Flexfabric 11900 Fundamentals Command Reference

64
Related commands
• display role
• role
• vlan policy deny
permit vpn-instance
Use permit vpn-instance to configure a list of VPNs accessible to a user role.
Use undo permit vpn-instance to disable the access of a user role to specific VPNs.
Syntax
permit vpn-instance vpn-instance-name&<1-10>
undo permit vpn-instance [ vpn-instance-name&<1-10> ]
Default
No permitted VPNs are configured in user role VPN instance policy.
Views
User role VPN instance policy view
Predefined user roles
network-admin
mdc-admin
Parameters
vpn-instance-name&<1-10>: Specifies a space-separated list of up to 10 MPLS L3VPN names. Each
name is a case-sensitive string of 1 to 31 characters.
Usage guidelines
To permit a user role to access an MPLS L3VPN after you configure the vpn-instance policy deny
command, you must add the VPN to the permitted VPN list of the policy. With the user role, you can
create, remove, configure only the VPNs in the permitted VPN list, enter their views, and specify them in
a feature command.
You can repeat the permit vpn-instance command to add permitted MPLS L3VPNs to a user role interface
policy.
The undo permit interface command removes the entire list of permitted VPNs if no VPN is specified.
Any change to a user role VPN instance policy takes effect only on users who log in with the user role
after the change.
Examples
1. Permit the user role role1 to access VPN 1 and to execute all commands available in system view
and in the child views of system view.
<Sysname> system-view
[Sysname] role name role1
[Sysname-role-role1] rule 1 permit command system-view ; *
[Sysname-role-role1] vpn policy deny
[Sysname-role-role1-vpnpolicy] permit vpn-instance vpn1
2. Verify that you cannot use the user role to work on any VPN but VPN 1: