User Roles
network-operator
Complete read access to the switch.
If you belong to multiple roles, you can execute a combination of all the commands permitted by these
Note
roles. Access to a command takes priority over being denied access to a command. For example, suppose
a user has RoleA, which denied access to the configuration commands. However, the user also has RoleB,
which has access to the configuration commands. In this case, the user has access to the configuration
commands.
Only network-admin user can perform a Checkpoint or Rollback in the RBAC roles. Though other users
Note
have these commands as a permit rule in their role, the user access is denied when you try to execute these
commands.
Predefined SAN Admin User Role
The SAN admin user role is a noneditable, predefined user role that is designed to provide separation between
LAN and SAN administrative tasks. Users that have been assigned the SAN admin user role have read-only
access to all Ethernet configuration tasks. Write access for Ethernet features is not granted to SAN admin
users unless it is assigned to them through another user role.
The following capabilities are permitted to SAN admin users:
• Interface configuration
• Attribute configuration for Fibre Channel Unified Ports, except creation and deletion
• VSAN configuration, including database and membership
• Mapping of preconfigured VLANs for FCoE to VSANs
• Zoning configuration
• Configuration of SNMP-related parameters, except SNMP community and SNMP users
• Read-only access to all other configurations
• Configuration and management of SAN features such as the following:
Cisco Nexus 5600 Series NX-OS System Management Configuration Guide, Release 7.x
70
◦ FC-SP
◦ FC-PORT-SECURITY
◦ FCoE
◦ FCoE-NPV
◦ FPORT-CHANNEL-TRUNK
◦ PORT-TRACK
◦ FABRIC-BINDING
Configuring User Accounts and RBAC
OL-31641-01