Information About User Accounts and RBAC
Cisco Nexus Series switches use role-based access control (RBAC) to define the amount of access that each user has when the user logs into the switch.
With RBAC, you define one or more user roles and then specify which management operations each user role is allowed to perform. When you create a user account for the switch, you associate that account with a user role, which then determines what the individual user is allowed to do on the switch.
User Roles
User roles contain rules that define the operations allowed for the user who is assigned the role. Each user role can contain multiple rules and each user can have multiple roles. For example, if role1 allows access only to configuration operations, and role2 allows access only to debug operations, users who belong to both role1 and role2 can access configuration and debug operations. You can also limit access to specific VSANs, VLANs, and interfaces.
The switch provides the following default user roles:
- network-admin (superuser)
-
Complete read and write access to the entire switch.
- network-operator
-
Complete read access to the switch. However, the network-operator role cannot run the show running-config and show startup-config commands.
- san-admin
-
Complete read and write access to Fibre Channel and FCoE administrative tasks using SNMP or CLI.
Note |
If you belong to multiple roles, you can execute a combination of all the commands permitted by these roles. Access to a command takes priority over being denied access to a command. For example, suppose a user has RoleA, which denied access to the configuration commands. However, the user also has RoleB, which has access to the configuration commands. In this case, the user has access to the configuration commands. |
Note |
Only network-admin user can perform a Checkpoint or Rollback in the RBAC roles. Though other users have these commands as a permit rule in their role, the user access is denied when you try to execute these commands. |
Predefined SAN Admin User Role
The SAN admin user role is a noneditable, predefined user role that is designed to provide separation between LAN and SAN administrative tasks. Users that have been assigned the SAN admin user role have read-only access to all Ethernet configuration tasks. Write access for Ethernet features is not granted to SAN admin users unless it is assigned to them through another user role.
The following capabilities are permitted to SAN admin users:
-
Interface configuration
-
Attribute configuration for Fibre Channel Unified Ports, except creation and deletion
-
VSAN configuration, including database and membership
-
Mapping of preconfigured VLANs for FCoE to VSANs
-
Zoning configuration
-
Configuration of SNMP-related parameters, except SNMP community and SNMP users
-
Read-only access to all other configurations
-
Configuration and management of SAN features such as the following:
-
FC-SP
-
FC-PORT-SECURITY
-
FCoE
-
FCoE-NPV
-
FPORT-CHANNEL-TRUNK
-
PORT-TRACK
-
FABRIC-BINDING
-
-
Configuration and management for the following of EXEC mode commands:
-
DEBUG
-
FCDOMAIN
-
FCPING
-
SAN-PORT-CHANNEL
-
SHOW
-
ZONE
-
ZONESET
-
Note |
The SAN Admin role permits configuration on all interface types, not just Fibre Channel interfaces. The predefined SAN Admin user role was designed to allow access to all interfaces—including Ethernet interfaces—so it would not interfere with SNMP operations. |
Rules
The rule is the basic element of a role. A rule defines what operations the role allows the user to perform. You can apply rules for the following parameters:
- Command
-
A command or group of commands defined in a regular expression.
- Feature
-
Commands that apply to a function provided by the Cisco Nexus device. Enter the show role feature command to display the feature names available for this parameter.
- Feature group
-
Default or user-defined group of features. Enter the show role feature-group command to display the default feature groups available for this parameter.
These parameters create a hierarchical relationship. The most basic control parameter is the command. The next control parameter is the feature, which represents all commands associated with the feature. The last control parameter is the feature group. The feature group combines related features and allows you to easily manage the rules.
You can configure up to 256 rules for each role. The user-specified rule number determines the order in which the rules are applied. Rules are applied in descending order. For example, if a role has three rules, rule 3 is applied before rule 2, which is applied before rule 1.
SAN Admin Role-Feature Rule Mapping
The SAN admin role is not editable. The following role-features are part of preconfigured role. The preconfigured role comes complete read access and the following rules:
Feature |
Permissions |
---|---|
copy |
Read and write permissions for copy-related commands |
fabric-binding |
Read and write permissions for fabric binding-related commands |
fcdomain |
Read and write permissions for Fibre Channel domain-related commands |
fcfe |
Read and write permissions for Fibre Channel FE-related commands |
fcmgmt |
Read and write permissions for Fibre Channel management-related commands |
fcns |
Read and write permissions for Fibre Channel-related service FCNS commands |
fcoe |
Read and write permissions for Fibre Channel over Ethernet-related commands |
fcsp |
Read and write permissions for Fibre Channel Security Protocol (FCSP)-related commands |
fdmi |
Read and write permissions for Fabric Device Management Interface (FDMI)-related commands |
fspf |
Read and write permissions for Fabric Shortest Path First (FSPF)-related commands |
interface |
Read and write permissions for interface-related commands, which includes all interfaces, not just Fibre Channel interfaces. |
port-track |
Read and write permissions for port track-related commands |
port-security |
Read and write permissions for port security-related commands |
rdl |
Read and write permissions for Remote Domain Loopback (RDL)-related commands |
rmon |
Read and write permissions for RMON-related commands |
rscn |
Read and write permissions for Registered State Change Notification (RSCN)-related commands |
snmp |
Read and write permissions for SNMP-related commands |
snmpTargetAddrEntry |
Read and write permissions for SNMP trap target-related commands |
snmpTargetParamsEntry |
Read and write permissions for SNMP trap target parameter-related commands |
span |
Read and write permissions for SPAN-related commands |
trapRegEntry |
Read and write permissions for SNMP trap registry-related commands |
trunk |
Read and write permissions for Fibre Channel port channel trunk-related commands |
vsan |
Read and write permissions for VSAN-related commands |
vsanIfvsan |
Read and write permissions for FCoE VLAN-VSAN mapping command-related commands |
wwnm |
Read and write permissions for World Wide Name (WWN)-related commands |
zone |
Read and write permissions for zoning commands |
User Role Policies
You can define user role policies to limit the switch resources that the user can access, or to limit access to interfaces, VLANs, and VSANs.
User role policies are constrained by the rules defined for the role. For example, if you define an interface policy to permit access to specific interfaces, the user does not have access to the interfaces unless you configure a command rule for the role to permit the interface command.
If a command rule permits access to specific resources (interfaces, VLANs, or VSANs), the user is permitted to access these resources, even if the user is not listed in the user role policies associated with that user.
User Account Configuration Restrictions
The following words are reserved and cannot be used to configure users:
-
adm
-
bin
-
daemon
-
ftp
-
ftpuser
-
games
-
gdm
-
gopher
-
halt
-
lp
-
mail
-
mailnull
-
man
-
mtsuser
-
news
-
nobody
-
san-admin
-
shutdown
-
sync
-
sys
-
uucp
-
xfs
Caution |
The Cisco Nexus 5000 and 6000 Series switch does not support all numeric usernames, even if those usernames were created in TACACS+ or RADIUS. If an all numeric username exists on an AAA server and is entered during login, the switch rejects the login request. Usernames must begin with an alphanumeric character and can contain only these special characters: ( + = . _ \ -). The # and ! symbols are not supported. If the username contains characters that are not allowed, the specified user is unable to log in. Effective from Cisco NX-OS release 7.3(0)N1(1), usernames starting with _(underscore) are supported. |
User Password Requirements
Cisco Nexus device passwords are case sensitive and can contain alphanumeric characters only. Special characters, such as the dollar sign ($) or the percent sign (%), are not allowed.
Note |
Starting from Cisco NX-OS Release 7.2(0)N1(1), special characters, such as the dollar sign ($) or the percent sign (%), can be used in Cisco Nexus device passwords. |
If a password is trivial (such as a short, easy-to-decipher password), the Cisco Nexus device rejects the password. Be sure to configure a strong password for each user account. A strong password has the following characteristics:
-
At least eight characters long
-
Does not contain many consecutive characters (such as "abcd")
-
Does not contain many repeating characters (such as "aaabbb")
-
Does not contain dictionary words
-
Does not contain proper names
-
Contains both uppercase and lowercase characters
-
Contains numbers
The following are examples of strong passwords:
-
If2CoM18
-
2009AsdfLkj30
-
Cb1955S21
Note |
For security reasons, user passwords do not display in the configuration files. |