Cisco Nexus 9000 Series Configuration Manual page 190

Creating User Roles and Rules
Command or Action
switch(config-role)# rule 3 permit read feature
router-bgp
Step 6 rule number {deny | permit} {read | read-write}
feature-group group-name
Example:
switch(config-role)# rule 4 deny read-write
feature-group L3
Step 7 rule number {deny | permit} {read | read-write} oid
snmp_oid_name
Example:
switch(config-role)# rule 5 deny read-write oid
1.3.6.1.2.1.1.9
Step 8 (Optional) description text
Example:
switch(config-role)# description This role does
not allow users to use clear commands
Step 9
exit
Example:
switch(config-role)# exit
switch(config)#
Step 10 (Optional) show role
Example:
switch(config)# show role
Step 11 (Optional) show role {pending | pending-diff}
Example:
switch(config)# show role pending
Step 12 (Optional) role commit
Example:
switch(config)# role commit
Step 13 (Optional) copy running-config startup-config
Example:
switch(config)# copy running-config startup-config
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
164
Configuring User Accounts and RBAC
Purpose
Repeat this command for as many rules as needed.
Configures a read-only or read-and-write rule for a feature
group.
Use the show role feature-group command to display a
list of feature groups.
Repeat this command for as many rules as needed.
Configures a read-only or read-and-write rule for an SNMP
object identifier (OID). You can enter up to 32 elements
for the OID. This command can be used to allow
SNMP-based performance monitoring tools to poll devices
but restrict their access to system-intensive branches such
as the IP routing table, MAC address tables, specific MIBs,
and so on.
Note The deepest OID can be at the scalar level or
at the table root level.
Repeat this command for as many rules as needed.
Configures the role description. You can include spaces
in the description.
Exits role configuration mode.
Displays the user role configuration.
Displays the user role configuration pending for
distribution.
Applies the user role configuration changes in the
temporary database to the running configuration.
Copies the running configuration to the startup
configuration.