Cisco Nexus - User administration

[enazevedo]

In addition to TACACS+, there some segregation to administrators of Nexus?

This issue arose with the arrival of Nexus in our network, and we have two separated teams of support, one from LAN, and another to SAN.

Regards,

E. Azevedo

[rkirkeby]

Yes the Nexus is also operating with roles, you can use the predefined roles or define you own, following that you associate different usernames with these roles or if you use ACS you can define Shell profiles that will do the same.

I used this guide when configued it for our setup.

http://www.cisco.com/en/US/products/ps9670/products_configuration_example09186a0080b2f941.shtml

Hope it helps.

[enazevedo]

Rene, tks for the reply!

But acctually, i'm looking for some more simples segregated access. Now that i understand the concept of RBAC through your link, i'm looking for something like that:

role: network-lan-administrador
role: network-san-administrador

Without has to set manually which command each administrador has permission.

Regards.

[rkirkeby · Accepted solution]

If you can settle with the two predefined roles, which are

network-admin (superuser)—Complete read and write access to the entire switch.

network-operator—Complete read access to the switch.

In that case you just need to defined the users in the switch

username USER1 password 5 XXXXXXXXXXX  role network-admin

username USER2 password 5 XXXXXXXXXXX role network-operator

username USER3 password 5 XXXXXXXXXXX role network-operator

etc

Or do you require all admins to have some degree or write access, in this case you will to have to create you own roles and subsequent assing them to the users, but you dont have to define a seperate role for each individual user, I would guess your lan administrator will have full access so for these you can use the network-admin role, then you just need to define the san-administrator role and its commands.

[enazevedo]

That's a way Rene...

Tks for your attention.