Juniper JUNOSE 11.3, Configuration Manual

Page: 463 / 632

NOTE: This classification is independent of the command access levels
configurable through the Initial-CLI-Access-Level VSA.
The VSA Allow-All-VR-Access controls access; the VSA Virtual-Router controls the VR
to which the user logs in, and the VSA Alt-CLI-Virtual-Router-Name specifies which VRs
other than the VR specified by the VSA virtual-router are accessible to restricted users.
See Table 48 on page 433.
Table 48: Juniper Networks–Specific Virtual Router Access VSA
Descriptions
Value
Subtype
Length
Subtype Length Type Description VSA
Integer:
0 – disable,
1 – enable sublen 19 len 26 Specifies user
access to all
virtual routers. Allow-All-VR-Access
String:
virtual-router
-name
sublen 1 len 26 Specifies the
VR to which
the user logs in
or the only VR
to which a user
has access.
The default
setting is the
default VR. Virtual-Router
String:
virtual-router
-name
sublen 21 len 26 Specifies a VR,
other than the
VR specified
by the
Virtual-Router
VSA, to which
the user has
access. You
can define this
VSA multiple
times to define
a set of VRs to
which a user
has access. Alt-CLI-Virtual-Router-
Name
VSA Configuration Examples
Consider a router on which five VRs have been configured. The VRs are called Boston,
Chicago, Detroit, Los Angeles, and San Francisco. The following examples illustrate how
to use the VSAs to control a user’s access to these VRs.
Example 1 In this example, you want the user to have access to all VRs and to log in to the default
VR. Accept the default setting or set the following VSA:
433 Copyright © 2010, Juniper Networks, Inc.
Chapter 7: Passwords and Security