only to configuration operations, and role2 allows access only to debug operations, then users who belong to
both role1 and role2 can access configuration and debug operations. You can also limit access to specific
virtual routing and forwarding instances (VRFs), VLANs, and interfaces.
The Cisco NX-OS software provides the following user roles:
• network-admin—Complete read-and-write access to the entire Cisco NX-OS device
• network-operator or vdc-operator—Complete read access to the entire Cisco NX-OS device
• The Cisco Nexus 9000 Series switches do not support multiple VDCs;
however, the vdc-operator role is available and has the same privileges and
limitations as the network-operator role.
• The Cisco Nexus 9000 Series switches support a single VDC due to which
the vdc-admin has the same privileges and limitations as the network-admin.
Note
You cannot change the user roles.
Note
Some
show
commands may be hidden from network-operator users. In addition, some non-
show
commands
(such as
telnet
) may be available for this user role.
Note
By default, the user accounts without an administrator role can access only the
show
,
exit
,
end
, and
configure
terminal
commands. You can add rules to allow users to configure features.
If you belong to multiple roles, you can execute a combination of all the commands permitted by these roles.
Access to a command takes priority over being denied access to a command. For example, suppose a user has
RoleA, which denied access to the configuration commands. However, the user also has RoleB, which has
access to the configuration commands. In this case, the user has access to the configuration commands.
Note
User Role Rules
The rule is the basic element of a role. A rule defines what operations the role allows the user to perform. You
can apply rules for the following parameters:
Command
A command or group of commands defined in a regular expression.
Feature
A command or group of commands defined in a regular expression.
Feature group
Default or user-defined group of features.
OID
An SNMP object identifier (OID).
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
157
Configuring User Accounts and RBAC
User Role Rules
