Chapter 3 Configuring Role-Based Administration; Domains - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

CHAPTER 3
Configuring Role-Based Administration
Role-Based Administration

Domains

Copyright © 2010, Juniper Networks, Inc.
This chapter details how to use the Juniper Networks Network and Security Manager
(NSM) role-based administration (RBA) feature to configure domains, administrators,
and roles to manage your network. Your organization probably already has an existing
permission structure that is defined by job titles, responsibilities, and geographical access
to your security devices. Using role-based administration, you can re-create the same
permission structure in NSM.
RBA is particularly useful for Enterprise and Service Provider organizations that have
different administrative roles associated with managing a large network and security
infrastructure. You can define custom roles with specific permissions to create the exact
administration structure your organization requires.
After you have created an RBA-based structure for your network, you can begin thinking
about your central management strategy and how to prepare your network for NSM.
NSM includes many features specifically designed for managing multiple Juniper Networks
devices, such as device groups and templates.
This chapter contains the following sections:
Role-Based Administration on page 61
Using Role-Based Administration Effectively on page 63
Configuring Role-Based Administration on page 66
The NSM role-based administration (RBA) feature enables you to define strategic roles
for your administrators, delegate management tasks, and enhance existing permission
structures using task-based functions.
Use NSM to create a secure environment that reflects your current administrator roles
and responsibilities. By specifying the exact tasks your NSM administrators can perform
within a domain, you minimize the probability of errors and security violations, and enable
a clear audit trail for every management event.
A domain is a logical grouping of devices, their security policies, and their access privileges.
A domain can contain devices, templates, objects, policies, VPNs, administrators, activities,
61