System Setup and Software Installation Guide for Cisco NCS 1004

PDF

System Setup and Software Installation Guide for Cisco NCS 1004

Create data rules

Updated: September 19, 2026

Want to summarize with AI?

Log in

Use this procedure to create data rules to permit or deny users in a user group from accessing and modifying configuration data elements.

Use this procedure to create data rules that control user access to configuration data elements.

Data rules determine whether users in a user group can access and modify configuration data elements. Data rules are linked to a user group and apply to all users within that group.

Each data rule is identified by an associated number. When a user group has multiple data rules, the rule with the lowest number takes precedence.

To create data rules, you must complete these subtasks:

  1. Configure the data rule parameters

  2. Apply data rule to user group

Before you begin

Create a user group. For details, see Create a user group.

Procedure

  1. Configure the data rule parameters. See Configure data rule parameters for details.

  2. Apply data rule to user group. See Apply data rule to user group for details.

Configure data rule parameters

Use this procedure to create a data rule and configure its basic parameters.

This is the first subtask for creating data rules. In this subtask, you create the data rule, specify the data element keypath, define the operations, and set the permission action.

Before you begin

Create a user group. For details, see Create a user group.

Procedure

  1. Enter the admin command to access the System Admin EXEC mode.

    Example:

    RP/0/RP0/CPU0:ios# admin

  2. Enter the config command to access the System Admin config mode.

    Example:

    sysadmin-vm:0_RP0# config

  3. Enter the aaa authorization datarules datarule data_rule_number command to create a data rule.

    Example:

    sysadmin-vm:0_RP0#(config)# aaa authorization datarules datarule 1100

    This command specifies a numeric value as the data rule number. You can enter a 32-bit integer.

    Do not use numbers between 1 to 1000 because they are reserved by Cisco.

    This command creates a new data rule and enters the data rule configuration mode. In the example, data rule 1100 is created.

    Note

    The system creates data rule 1 by default when the root-system user is created. This data rule provides accept permission to read, write, and execute operations for all the configuration data. As a result, the root user has no restrictions unless data rule 1 is modified.

  4. Enter the keypath keypath command to specify the key path of the data element.

    Example:

    sysadmin-vm:0_RP0#(config-datarule-1100)# keypath /aaa/disaster-recovery

    The key path is an expression defining the location of the data element. Entering an asterisk (*) as the keypath makes the command rule apply to all the configuration data.

  5. Enter the ops operation command to specify the operation for which permission is set.

    Example:

    sysadmin-vm:0_RP0#(config-datarule-1100)# ops rw

    Use these letters to identify various operations:

    • c: create

    • d: delete

    • u: update

    • w: write (a combination of create, update, and delete)

    • r: read

    • x: execute

  6. Enter the action {accept | accept_log | reject} command to specify whether users may perform the operation.

    Example:

    sysadmin-vm:0_RP0#(config-datarule-1100)# action reject

    This command specifies whether to permit or deny users to perform the operation:

    • accept: permit users to perform the operation.

    • accept_log: permit users to perform the operation and log every access attempt.

    • reject: restrict users from performing the operation.

What to do next

Apply the data rule to a user group. For details, see Apply data rule to user group.

Apply data rule to user group

Use this procedure to apply a data rule to a user group and finalize the configuration.

This is the second subtask for creating data rules. In this subtask, you apply the data rule to a user group. You also specify the connection context and namespace, and then commit the configuration.

Before you begin

Configure data rule parameters. For details, see Configure data rule parameters.

Procedure

  1. Enter the group user_group_name command to specify the user group to which the data rule applies.

    Example:

    sysadmin-vm:0_RP0#(config-datarule-1100)# group gr1

    You can also specify multiple group names.

  2. Enter the context connection_type command to specify the connection type to which this rule applies.

    Example:

    sysadmin-vm:0_RP0#(config-datarule-1100)# context *

    The connection type can be netconf (Network Configuration Protocol), cli (Command Line Interface), or xml (Extensible Markup Language). Enter an asterisk (*), which indicates that the command applies to all connection types.

  3. Enter the namespace namespace command to specify the namespace.

    Example:

    sysadmin-vm:0_RP0#(config-datarule-1100)# namespace *

    Enter asterisk * to indicate that the data rule is applicable to all the namespace values.

  4. Enter the commit or end command to save the configuration.

    The commit command saves the configuration changes and remains within the configuration session.

    The end command prompts you to take one of these actions:

    • Yes: saves configuration changes and exits the configuration session.

    • No: exits the configuration session without committing the configuration changes.

    • Cancel: remains in the configuration session without committing the configuration changes.