User Manual

NETGEAR M4500 Series Switches CLI Command Reference Manual 620
5.31. Role-Based Access Control
Role-Based Access Contro (RBAC) allows you to create roles which define CLI executive permissions of individual
functions, and assign roles to a user let him own the suitable authorization to manage and operate the system
User Role
A role contains one or multiple rules that define the operations allowed for the user who is assigned the role,
and one user can have multiple roles. For example, if role1 allows managing layer 3 routing functions and role2
allows managing VLAN function, then a user who has both role1 and role2 can manage routing and VLAN
functions.
By default, the switch supports the following user roles, which you cannot change or delete:
⚫ network-admin: it has full access commands to the entire system.
⚫ network-operator: it can access read-only commands to the entire system.
CLI command string inside a rule
A CLI command string is used to define a rule whether to allow one or one kind of CLI commands to execute. The
format of command string may be whole and explicit CLI command, likes “ip igmp snooping querier vlan 1”, or
use wildcard character ‘*’ on the tail of command string to match any string after prefix string, likes “ip igmp
snooping *”.
Feature
Features are system predefined sets of CLI commands which are divided by related functions.
Feature Group
Feature group provides to bond multiple features into a group name and assign to a role. The system
administrator could customize different feature groups according to functional categories and give it an
appropriate nickname.
Rule
A rule defines what operation could be allowed to execute for a role, in other words, a role is made up of one or
many rules. A rule can be applied only one action which is a CLI command string, a feature, or a feature group.
Every role has an invisible default rule “deny all commands”, if a user enters a command which can’t match any
rule of its roles, this command won’t be permitted to execute.
Each rule must be assigned rule ID which is a unique integer between 1 and 256. All Rules in one role are applied
in descending order of role ID, and it means when one role has many rules and some of their definition are
conflicting, then the greater ID will be higher priority than less one.
For example, below role1 can execute all related commands about “show ip igmp”, except the command and
sub-commands of “show ip igmp snooping”:
Switch(config)# role name role1
Switch(config-role)# rule 1 permit command “show ip igmp *”
Switch(config-role)# rule 2 deny command “show ip igmp snooping *”