Cisco Catalyst SD-WAN User Management Guide, Releases 26.x and Later

PDF

Configure RBAC

Updated: April 24, 2026

Want to summarize with AI?

Log in

Provides comprehensive guidance on configuring Role-Based Access Control, including defining scopes, creating and editing roles, copying custom roles, and deleting roles to enforce security.

Configure scope

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Administration > Users and Access.

By default Scope menu is selected. The table displays the list of scopes configured in the device.
2.

Click Add Scope.
3.

Enter Scope Name and Description.

4.

Click Add Nodes.
5.

Choose the required nodes and click Save.

You can click Edit Nodes to update the existing nodes in the list.
6.

(Optional) In the Associations pane, click Add Users to associate users.

  1. In the Add Users pop-up window, choose the users that you want to add.

  2. Click Save.

    The selected users are associated to a scope.
7.

(Optional) In the Configurations tab, click Add Configurations to add configurations. Choose the available configurations from the following tabs:

  1. Configuration Group

  2. Device Template

  3. Feature Template

  4. Feature Profile

  5. Security Policy

  6. Localized Policy
8.

Click Save.

A new scope with nodes, users and required configurations is created.

Configure roles

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Administration > Users and Access.
2.

Click Roles.

The table displays the list of roles configured in the device.
3.

Click Add Role.
4.

Enter Custom Role Name in the Add Custom Role page.
5.

Select the Deny, Read, or Write check box against the feature or sub feature that you want to assign a role.
6.

Click Add.

You can view the new role in the table in the Roles page.

Copy custom role

To create a copy of a custom role, use these steps.

Procedure

1.

In the list of roles, for the role you wish to copy, click ..., and click Copy.

The Copy Custom Role page is displayed.
2.

Enter Custom Role Name.
3.

Select the Deny, Read, or Write check box against the feature or sub feature that you want to update for a role.
4.

Click Copy.

You can view the new role in the table in the Roles page.

Edit custom role

Procedure

1.

In the list of roles, for the role you wish to copy, click ..., and click Edit.

The Edit Custom Role page is displayed.
2.

Select the Deny, Read, or Write check box against the feature or sub feature that you want to update for a role.

Note

Starting from Cisco Catalyst SD-WAN Manager Release 20.18.1, the permissions for a role and its descendents may differ in the Deny/Read/Write table. Therefore, do not assume the parent role as the entire role for the sub-tree under it.

If you have a role with write permissions for Configuration Groups but deny or read permission for deploy, a Change device variables button appears instead of Deploy button. This button allows you to modify device-specific values during the deploy process, without initiating the deployment.
3.

Click Update.

You can view the updated role in the table in the Roles page.

Delete a role

You can delete a role when it is no longer needed. For example, you might delete a role that you created for a specific project when that project ends.

Procedure

1.

Choose the role you wish to delete, click ..., and click delete.

The Warning page is displayed.
2.

To confirm the deletion of the role, click Delete.

This deletes the role.