Verifying Vsan-Restricted Roles Using The Cli; User Cannot Configure E Ports - Cisco 9134 - MDS Multilayer Fabric Switch Troubleshooting Manual

Chapter 18 Troubleshooting Users and Roles
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Click Apply Changes to save these changes.
Step 4
Select the Roles CFS tab and select commit from the Config Action drop-down menu.
Step 5
Click Apply Changes to distribute these changes through the fabric.
Step 6

Verifying VSAN-Restricted Roles Using the CLI

To verify user role-based access using the CLI, follow these steps:
Use the show user-account command to view the roles assigned to the user.
Step 1
switch# show user-account user1
user:user1
no password set. local login not allowed
Remote login through RADIUS is possible
Use the show role command to view the rules assigned to the role.
Step 2
switch# show role sangroup
Role: sangroup
Description: SAN management group
vsan policy: deny
Permitted vsans: 10-30
---------------------------------------------
Rule
---------------------------------------------
Use the role command to modify the VSAN policy for a role.
Step 3
switch# role name sangroup
switch(config-role)# vsan policy deny
switch(config-role)# permit vsan 1 - 30

User Cannot Configure E Ports

Symptom
Table 18-7 User Cannot Configure E Ports
Symptom Possible Cause
User cannot configure User is assigned a VSAN-restricted
E ports. role.
OL-9285-05
this user account has no expiry date
roles:sangroup vsan-admin
Type Command-type
1. permit config
2. deny config
3. permit debug
4. permit exec
User cannot configure E ports.
Feature
*
fspf
zone
fcping
Solution
See the "Verifying VSAN-Restricted Roles Using Fabric
Manager" section on page 18-10
VSAN-Restricted Roles Using the CLI" section on
page 18-11.
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
User and Role Issues
or the "Verifying
18-11