HP Enterprise FlexFabric 12900E Series Command Reference Manual page 34

Usage guidelines
To permit a user role to access an interface after you configure the
command, you must add the interface to the permitted interface list of the policy. With the user role,
you can perform the following tasks to the interfaces in the permitted interface list:
•
Create, remove, or configure the interfaces.
•
Enter the interface views.
•
Specify the interfaces in feature commands.
The create and remove operations are available only for logical interfaces.
You can repeat the
role interface policy.
The
undo permit interface
not specify an interface.
Any change to a user role interface policy takes effect only on users who log in with the user role after
the change.
Examples
1. Configure user role role1:
# Permit user role role1 to execute all commands available in interface view and VLAN view.
<Sysname> system-view
[Sysname] role name role1
[Sysname-role-role1] rule 1 permit command system-view ; interface *
[Sysname-role-role1] rule 2 permit command system-view ; vlan *
# Permit the user role to access HundredGigE 1/0/1, and HundredGigE 1/0/3 to HundredGigE
1/0/5.
[Sysname-role-role1] interface policy deny
[Sysname-role-role1-ifpolicy] permit interface hundredgige 1/0/1 hundredgige 1/0/3
to hundredgige 1/0/5
[Sysname-role-role1-ifpolicy] quit
[Sysname-role-role1] quit
2. Verify that you cannot use user role role1 to work on all interfaces except for HundredGigE
1/0/1 and HundredGigE 1/0/3 to HundredGigE 1/0/5:
# Verify that you can enter HundredGigE 1/0/1 interface view.
[Sysname] interface hundredgige 1/0/1
[Sysname-HundredGigE1/0/1] quit
# Verify that you can assign HundredGigE 1/0/5 to VLAN 10. In this example, the user role can
access all VLANs because the default VLAN policy of the user role is used.
[Sysname] vlan 10
[Sysname-vlan10] port hundredgige 1/0/5
[Sysname-vlan10] quit
# Verify that you cannot enter interface view of HundredGigE 1/0/2.
[Sysname] interface hundredgige 1/0/2
Permission denied.
Related commands
display role
interface policy deny
role
permit interface
command removes the entire list of permitted interfaces if you do
command to add multiple permitted interfaces to a user
28
interface policy deny