H3C SOHO IE4300, Command Reference Manual

Page: 40 / 3296

19
[Sysname-role-role1] rule 1 permit command system-view ; *
# Permit the user role to access VPN instance vpn1 .
[Sysname-role-role1] vpn policy deny
[Sysname-role-role1-vpnpolicy] permit vpn-instance vpn1
[Sysname-role-role1-vpnpolicy] quit
[Sysname-role-role1] quit
2. Verify that you cannot use user role role1 to work on any VPN instances except for vpn1 :
# Verify that you can enter the view of vpn1 .
[Sysname] ip vpn-instance vpn1
[Sysname-vpn-instance-vpn1] quit
# Verify that you can specify the primary accounting server at 10.110.1.2 in VPN instance vpn1
for RADIUS scheme radius1 .
[Sysname] radius scheme radius1
[Sysname-radius-radius1] primary accounting 10.110.1.2 vpn-instance vpn1
[Sysname-radius-radius1] quit
# Verify that you cannot create VPN instance vpn2 or enter VPN instance view.
[Sysname] ip vpn-instance vpn2
Permission denied.
Related commands
display role
role
vpn-instance policy deny
role
Use
role
to create a user role and enter its view, or enter the view of an existing user role.
Use undo role to delete a user role.
Syntax
role name role-name
undo role name role-name
Default
The system has the following predefined user roles: network-admin, network-operator, level- n
(where n represents an integer in the range of 0 to 15), and security-audit.
Views
System view
Predefined user roles
network-admin
Parameters
name role-name
: Specifies a username. The
role-name
argument is a case-sensitive string of
1 to 63 characters.
Usage guidelines
You can create a maximum of 64 user roles in addition to the predefined user roles.