Configuring access profiles
Access profiles provision permissions to roles. The following permissions can be assigned:
• Read (view access)
• Read-Write (view, change, and execute access)
• No access
When an administrator has only read access to a feature, the administrator can access the web UI page for that feature, and can use the get and show CLI command for that feature, but cannot make changes to the configuration.
In larger companies where multiple administrators divide the share of work, access profiles often reflect the specific job that each administrator does (“role”), such as account creation or log auditing. Access profiles can limit each administrator account to their assigned role. This is sometimes called role-based access control (RBAC).
Table 53 lists the administrative areas that can be provisioned. If you provision read access, the role can view the web UI menu (or issue a CLI get command). If you provision read-write access, the role can save configuration changes (or issue a CLI set command).
For complete access to all commands and abilities, you must log in with the administrator account named admin.,
Table 53: Areas of control in access profiles
Web UI Menus | CLI Commands |
System | config system diagnose hardware diagnose sniffer diagnose system execute date execute ha execute ping execute ping-options execute traceroute execute time |
Networking | config router |
Server Load Balance | config load-balance diagnose policy |
Link Load Balance | config link-load-balance diagnose policy |
Global Load Balance | config global-dns-load-balance diagnose policy |
Security | config firewall |
Log & Report | config log config report execute formatlogdisk |
|
Before you begin:
• You must have Read-Write permission for System settings.
To configure administrator profiles:
1. Go to System > Administrator.
2. Click the Access Profile tab.
3. Click Add to display the configuration editor.
4. Complete the configuration as described in
Table 54.
5. Save the configuration.
Table 54: Access profile configuration
Settings | Guidelines |
Profile Name | Unique name. No spaces or special characters. |
Access Control | For each category, set the permission: • None—Do not provision access for the menu. • Read Only—Provision ready-only access. • Read-Write—Enable the role to make changes to the configuration. |
| The super_admin_prof access profile, a special access profile assigned to the admin account and required by it, appears in the list of access profiles. It exists by default and cannot be changed or deleted. The profile has permissions similar to the UNIX root account. |