HP 12500 Configuration Manual page 24

A user role can have multiple rules uniquely identified by rule numbers. The set of permitted commands
in these rules are accessible to the user role. If two rules conflict, the one with higher number takes effect.
For example, if rule 1 permits the ping command, rule 2 permits the tracert command, and rule 3 denies
the ping command, the user role can use the tracert command but not the ping command.
Resource access policies
Resource access policies control access of user roles to system resources and include the following types:
Interface policy—Controls access to interfaces.
•
• VLAN policy—Controls access to VLANs.
VPN instance policy—Controls access to VPNs.
•
Resource access policies do not control access to the interface, VLAN, or VPN options in the display
commands. You can specify these options in the display commands if they are permitted by any user role
rule.
Predefined user roles
The system provides 20 predefined user roles. All these user roles have access to all system resources
(interfaces, VLANs, and VPNs), but their command access permissions (see
Among all the predefined user roles, only the user roles network-admin, mdc-admin, and level- 1 5 can
access the RBAC feature, and change the settings including user-role, authentication-mode, protocol,
and set authentication password in user interface view.
All the predefined user roles are available for the default MDC. The user roles network-admin and
network-operator are not available for non-default MDCs. For more information about MDCs, see
"Configuring MDCs."
Table 6 Predefined roles and permissions matrix
User role name
network-admin
network-operator
mdc-admin
mdc-operator
Permissions
Accesses all features and resources in the system.
•
Accesses the display commands (except display history-command all)
for all features and resources in the system.
•
Switches between MDC views.
•
Enables local authentication login users to change their own password.
Accesses all the features and resources in the administered MDC.
•
Accesses the display commands (except display history-command all)
for all the features and resources available in the administered MDC.
•
Enables local authentication login users to change their own password.
16
Table 6) differ.