What to do next
Create data rules. See
Create Data Rules
Data rules are rules based on which users of the user group are either permitted, or denied, accessing and
modifying configuration data elements. The data rules are associated to a user group. The data rules get applied
to all users who are part of the user group.
Each data rule is identified by a number associated to it. When multiple data rules are applied to a user group,
the data rule with a lower number takes precedence.
Before you begin
Create an user group. See
Create a User Group, on page 39
.
Procedure
Step 1
admin
Example:
RP/0/RP0/CPU0:ios# admin
Enters System Admin EXEC mode.
Step 2
configure
Example:
sysadmin-vm:0_RP0# configure
Enters System Admin Config mode.
Step 3
aaa authorization datarules datarule data_rule_number
Example:
sysadmin-vm:0_RP0#(config)#aaa authorization datarules datarule 1100
Specify a numeric value as the data rule number. You can enter a 32 bit integer.
Do no use numbers between 1 to 1000 because they are reserved by Cisco.
Important
This command creates a new data rule (if it is not already present) and enters the data rule configuration mode.
In the example, data rule "1100" is created.
By default "datarule 1" is created by the system when the root-system user is created. This data rule
provides "accept" permission to "read", "write", and "execute" operations for all configuration data.
Therefore, the root user has no restrictions imposed on it, unless "datarule 1" is modified.
Note
Step 4
keypath keypath
Example:
sysadmin-vm:0_RP0#(config-datarule-1100)#keypath
/aaa/disaster-recovery
System Setup and Software Installation Guide for Cisco NCS 1002
43
Create User Profiles and Assign Privileges
Create Data Rules
