Rules; San Admin Role-Feature Rule Mapping - Cisco Nexus 5600 Series Configuration Manual

Configuring User Accounts and RBAC
• Configuration and management for the following of EXEC mode commands:
The SAN Admin role permits configuration on all interface types, not just Fibre Channel interfaces. The
Note
predefined SAN Admin user role was designed to allow access to all interfaces—including Ethernet
interfaces—so it would not interfere with SNMP operations.

Rules

The rule is the basic element of a role. A rule defines what operations the role allows the user to perform. You
can apply rules for the following parameters:
Command
Feature
Feature group
These parameters create a hierarchical relationship. The most basic control parameter is the command. The
next control parameter is the feature, which represents all commands associated with the feature. The last
control parameter is the feature group. The feature group combines related features and allows you to easily
manage the rules.
You can configure up to 256 rules for each role. The user-specified rule number determines the order in which
the rules are applied. Rules are applied in descending order. For example, if a role has three rules, rule 3 is
applied before rule 2, which is applied before rule 1.

SAN Admin Role-Feature Rule Mapping

The SAN admin role is not editable. The following role-features are part of preconfigured role. The
preconfigured role comes complete read access and the following rules:
OL-31641-01
◦ DEBUG
◦ FCDOMAIN
◦ FCPING
◦ SAN-PORT-CHANNEL
◦ SHOW
◦ ZONE
◦ ZONESET
A command or group of commands defined in a regular expression.
Commands that apply to a function provided by the Cisco Nexus device. Enter the show role feature
command to display the feature names available for this parameter.
Default or user-defined group of features. Enter the show role feature-group command to display the
default feature groups available for this parameter.
Cisco Nexus 5600 Series NX-OS System Management Configuration Guide, Release 7.x
Rules
71