HP Enterprise FlexNetwork 10500 Series, Руководство по настройке, Страница: 41 / 325

32
[Switch-role-role1] quit
# Create a device management user named user1 and enter local user view.
[Switch] local-user user1 class manage
# Set a plaintext password of aabbcc for the user.
[Switch-luser-manage-user1] password simple aabbcc
# Set the service type to Telnet .
[Switch-luser-manage-user1] service-type telnet
# Assign role1 to the user.
[Switch-luser-manage-user1] authorization-attribute user-role role1
# Remove the default user role ( network-operator) from the user. This operation ensures that the
user has only the permissions of role1 .
[Switch-luser-manage-user1] undo authorization-attribute user-role network-operator
[Switch-luser-manage-user1] quit
Verifying the configuration
# Telnet to the switch, and enter the username and password to access the switch. (Details not
shown.)
# Verify that you can create VLANs 10 to 20. This example uses VLAN 10.
<Switch> system-view
[Switch] vlan 10
[Switch-vlan10] quit
# Verify that you cannot create any VLAN other than VLANs 10 to 20. This example uses VLAN 30.
[Switch] vlan 30
Permission denied.
# Verify that you can use all read commands of any feature. This example uses display clock .
[Switch] display clock
09:31:56 UTC Sat 01/01/2016
[Switch] quit
# Verify that you cannot use the write or execute commands of any feature.
<Switch> debugging role all
Permission denied.
<Switch> ping 192.168.1.58
Permission denied.
RBAC configuration example for RADIUS authentication
users
Network requirements
As shown in Figure 3 , the switch uses the FreeRADIUS server to provide AAA service for login users,
including the Telnet user. The user account for the Telnet user is hello@bbb and is assigned user
role role2 .
User role role2 has the following permissions:
•
Can use all commands in ISP view.
•
Can use the read and write commands of the arp and radius features.
•
Cannot access the read commands of the acl feature.