R21xx-HP FlexFabric 11900 Fundamentals Configuration Guide

# Configure rule 4 to permit the user role to create VLANs and use all commands available in

VLAN view.

[Switch-role-role2] rule 4 permit command system-view ; vlan *

# Configure rule 5 to permit the user role to enter interface view and use all commands available

in interface view.

[Switch-role-role2] rule 5 permit command system-view ; interface *

# Configure the user role VLAN policy to disable configuration of any VLAN except VLANs 1 to

20.

[Switch-role-role2] vlan policy deny

[Switch-role-role2-vlanpolicy] permit vlan 1 to 20

[Switch-role-role2-vlanpolicy] quit

# Configure the user role interface policy to disable configuration of any interface except

Ten-GigabitEthernet 1/0/1 to Ten-GigabitEthernet 1/0/24.

[Switch-role-role2] interface policy deny

[Switch-role-role2-ifpolicy] permit interface ten-gigabitethernet 1/0/1 to

ten-gigabitethernet 1/0/24

[Switch-role-role2-ifpolicy] quit

[Switch-role-role2] quit

2. Configure the RADIUS server:

# Add either of the user role attributes to the dictionary file of the FreeRADIUS server.

Cisco-AVPair = "shell:roles=\"role2\""

Cisco-AVPair = "shell:roles*\"role2\""

# Configure the settings required for the FreeRADIUS server to communicate with the switch.

(Details not shown.)

Verifying the configuration

# Telnet to the switch, and enter the username and password to access the user interface. (Details not

shown.)

# Verify that you can use all commands available in ISP view.

<Switch> system-view

[Switch] domain abc

[Switch-isp-abc] authentication login radius-scheme abc

[Switch-isp-abc] quit

# Verify that you can use all read and write commands of the features radius and arp. Take radius as an

example.

[Switch] radius scheme rad

[Switch-radius-rad] primary authentication 2.2.2.2

[Switch-radius-rad] display radius scheme rad

…

Output of the RADIUS scheme is omitted.

# Verify that you cannot configure any VLAN except VLANs 1 to 20. Take VLAN 10 and VLAN 30 as

examples.

[Switch] vlan 10

[Switch-vlan10] quit

[Switch] vlan 30

Permission denied.