Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 111 / 1026

CHAPTER 3
Configuring Role-Based Administration
This chapter details how to use the Juniper Networks Network and Security Manager
(NSM) role-based administration (RBA) feature to configure domains, administrators,
and roles to manage your network. Your organization probably already has an existing
permission structure that is defined by job titles, responsibilities, and geographical access
to your security devices. Using role-based administration, you can re-create the same
permission structure in NSM.
RBA is particularly useful for Enterprise and Service Provider organizations that have
different administrative roles associated with managing a large network and security
infrastructure. You can define custom roles with specific permissions to create the exact
administration structure your organization requires.
After you have created an RBA-based structure for your network, you can begin thinking
about your central management strategy and how to prepare your network for NSM.
NSM includes many features specifically designed for managing multiple Juniper Networks
devices, such as device groups and templates.
This chapter contains the following sections:
•
Role-Based Administration on page 61
• Using Role-Based Administration Effectively on page 63
• Configuring Role-Based Administration on page 66
Role-Based Administration
The NSM role-based administration (RBA) feature enables you to define strategic roles
for your administrators, delegate management tasks, and enhance existing permission
structures using task-based functions.
Use NSM to create a secure environment that reflects your current administrator roles
and responsibilities. By specifying the exact tasks your NSM administrators can perform
within a domain, you minimize the probability of errors and security violations, and enable
a clear audit trail for every management event.
Domains
A domain is a logical grouping of devices, their security policies, and their access privileges.
A domain can contain devices, templates, objects, policies, VPNs, administrators, activities,
61 Copyright © 2010, Juniper Networks, Inc.