The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This privilege allows a user to perform provisioning operations related to Authentication, Authorization and Accounting. This includes managing users and roles, and configuring services that are exposed to the management interfaces.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure SNMP policy, SNMP users, SNMP trap destinations.
Configure Key Ring. Import certificates of trusted authorities. Generate and import Certificates.
Configure users, roles, user locales, user sessions, login banner, authentication domains, authentication providers (LDAP, RADIUS, TACACS).
Configure DNS providers and DNS domain.
Configure whether communication policies are resolved locally or through UCS Central.
Configure UCS management connectivity: HTTP, HTTPs, SSH, telnet, CIM, WS-MAN, event channel security.
This privilege provides a user with full access to all operations in Cisco UCS Manager.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
This privilege has full access to all operations.
This privilege allows a user to configure LAN settings on a fabric interconnect, including Ethernet border ports, VLANs, LAN PIN groups, Ethernet SPAN sessions, LAN policies, and management interfaces.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure VLANs and VLAN groups.
Configure Ethernet border ports on the Fabric Interconnect. Add/remove VLANs to border ports.
Configure Ethernet monitoring sessions (SPAN).
Enable/Disable Ethernet/FC/iSCSI ports and port channels on a server adapter. Set port/port channel label.
Specify the allowed range for virtual MAC addresses.
Configure management interfaces monitoring policy.
Configure management interfaces (IPv4 and IPv6) on the Fabric Interconnect.
Enable/Disable Ethernet ports on a Fabric Interconnect or IO Module. Set port labels.
Configure Ethernet PIN Groups.
Configure Inband CIMC profile.
Configure Ethernet Link Profile and LACP policy.
Configure DNS providers and DNS domain.
Configure Fabric Interconnect system name.
Configure MAC aging properties. Specify Ethernet end-host or switching mode. Enable/Disable VLAN compression.
Configure NetFlow policies, exporters and collectors.
This privilege allows a user to configure LAN settings on a fabric interconnect, including Ethernet border ports, VLANs, LAN PIN groups, Ethernet SPAN sessions, LAN policies, and vNIC/vHBA placement policies
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure VLANs and VLAN groups.
Create/modify/delete vNIC/vHBA placement.
Configure Ethernet border ports on the Fabric Interconnect. Add/remove VLANs to border ports.
Configure Inband CIMC profile.
Configure Ethernet monitoring sessions (SPAN).
Configure Ethernet PIN Groups.
Enable/Disable Ethernet/FC/iSCSI ports and port channels on a server adapter. Set port/port channel label.
Configure Ethernet Link Profile and LACP policy.
Specify the allowed range for virtual MAC addresses.
Enable/Disable Ethernet ports on a Fabric Interconnect or IO Module. Set port labels.
Configure NetFlow policies, exporters and collectors.
Configure MAC aging properties. Specify Ethernet end-host or switching mode. Enable/Disable VLAN compression.
This privilege allows a user to configure QoS classes of service for Ethernet and Fibre Channel and to configure Ethernet MTU.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
All tasks inherited from privilege: ext-san-qos
This privilege allows a user to configure NTP providers, and date and time zone settings.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure NTP providers, date and time zone.
This privilege allows a user to configure SAN settings on a fabric interconnect, including FC/FCoE border ports, VSANs, SAN PIN groups, and Fibre Channel SPAN sessions.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
All tasks inherited from privilege: ext-san-policy
This privilege allows a user to configure SAN settings on a fabric interconnect, including FC/FCoE border ports, VSANs, SAN PIN Groups, and Fibre Channel SPAN sessions.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Specify Fibre Channel end-host or switching mode. Specify FC trunking mode.
Configure Fibre Channel monitoring sessions.
Configure storage connection within a Service Profile.
Create/modify/delete storage connection policies.
Configure the allowed range for virtual WWN addresses.
Configure Fibre Channel and FCoE ports on the Fabric Interconnect. Add/remove VSANs to FC ports. Configure the FCoE native VLAN.
Configure Fibre Channel PIN Groups.
Configure VSANs.
This privilege allows a user to configure QoS classes of service for Ethernet and Fibre Channel and to configure Ethernet MTU.
This privilege allows a user to configure fault policies, Call Home policies, and fault suppression policies. The user can also acknowledge faults in Cisco UCS Manager.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Acknowledge faults, configure fault policies (flap interval, soak interval, clear/ack action, limits, retention).
Configure whether fault policies are resolved locally or through UCS Central.
Configure Call Home policies. Used to send call home events when a fault is raised.
This privilege allows a user to configure most aspects of service profiles. However the user cannot create, modify or delete vNICs or vHBAs. You can use this privilege to enforce a strong separation between server, network, and storage provisioning activities. For example, a network administrator can create vNICs, a storage administrator can create vHBAs, and the server administrator can configure all other elements of a service profile
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Create/modify/delete local storage policies (disks and LUNs).
Associate and Disassociate Service Profiles.
Configure Storage Profiles. Assign storage profiles to Service Profiles.
Create/modify/delete Service Profiles/Templates. Assign policies to Service Profiles. Acknowledge service profile pending tasks.
Configure VMQ policies.
Configure schedules. Schedules can be used to trigger one-time or periodic tasks in the future.
Configure vHBA initiator groups.
Create/modify/delete host firmware packages.
Assign usNIC policies to service profile.
Configure Service Profile scriptable vMedia.
Configure iSCSI boot parameters.
Create/modify/delete Service Profile maintenance policies.
Create/modify/delete Service Profile dynamic vNICs within a Service Profile.
Assign storage profiles to Service Profiles.
Configure the vNIC/vHBA placement of a Service Profile.
Configure power policies and power placement.
Perform maintenance tasks on local disks, local LUNs and remote LUNs.
Configure Service Profile scriptable vMedia policies.
Configure Inband CIMC IP connectivity.
Configure Service Profile BIOS policies.
This privilege allows a user to configure service profiles and to configure distributed virtual switches (DVSes) in a VM-FEX environment.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Create/modify/delete local storage policies (disks and LUNs).
Assign port profiles to Distributed Virtual Switches.
Configure FC group templates.
Associate and Disassociate Service Profiles.
Configure Service Profile iSCSI vNICs.
Configure VMware vCenter cryptographic keys.
Configure VMware vCenter connections, datacenters, folders, switch.
Configure iSCSI boot parameters.
Create/modify/delete Service Profile maintenance policies.
Assign storage profiles to Service Profiles.
Create/modify/delete Service Profile dynamic vNICs within a Service Profile.
Configure SAN connectivity policies. Configure Service Profile vHBAs and add/remove VSANs on vHBAs.
Configure LAN connectivity policies. Configure Service Profile vNICs and add/remove VLANs on vNICs.
Configure vHBA behavior policy when vHBAs are not explicitly defined.
Configure power policies and power placement.
Perform maintenance tasks on local disks, local LUNs and remote LUNs.
Configure Service Profile scriptable vMedia policies.
Configure Inband CIMC IP connectivity.
Configure Service Profile BIOS policies.
Configure Service Profile vNICs storage initiator autoconfig policies.
Configure Storage Profiles. Assign storage profiles to Service Profiles.
Create/modify/delete Service Profiles/Templates. Assign policies to Service Profiles. Acknowledge service profile pending tasks.
Configure schedules. Schedules can be used to trigger one-time or periodic tasks in the future.
Configure Service Profile scriptable vMedia.
Configure the vNIC/vHBA placement of a Service Profile.
Configure vNIC behavior policy when vNICs are not explicitly defined.
Within a service profile, specify if vNICs/vHBAs should be inherited from the hardware when vNICs/vHBAs are not explicitly defined.
This privilege allows a user to configure policies that are applied to Service Profiles, including host firmware packages, local disk policies, boot policies, and Serial over LAN policies
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure Service Profile boot policies.
Create/modify/delete local storage policies (disks and LUNs).
Assign port profiles to Distributed Virtual Switches.
Create/modify/delete FC adapter policies.
Associate and Disassociate Service Profiles.
Create/modify/delete management firmware packages. This feature is deprecated.
Configure iSCSI authentication profile.
Configure VMware vCenter cryptographic keys.
Configure VMware vCenter connections, datacenters, folders, switch.
Create/modify/delete host firmware packages.
Configure Service Profile scriptable vMedia.
Create/modify/delete Service Profile maintenance policies.
Assign storage profiles to Service Profiles.
Configure Serial over LAN policies.
Configure power policies and power placement.
Configure Service Profile scriptable vMedia policies.
Create/modify/delete Ethernet adapter policies (Ethernet and iSCSI).
Service profile end point access
This privilege allows a user to configure network policies and network elements that are applied to service profile vNICs. A user can also configure other network elements that impact service profiles, such as server ports.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Assign port profiles to Distributed Virtual Switches.
Configure VM-FEX Port Profile policy.
Configure Service Profile iSCSI vNICs.
Specify the allowed range for virtual MAC addresses.
Configure VLAN and VLAN group org permissions.
Create/modify/delete Service Profile dynamic vNIC policies.
Configure VMQ policies.
Configure VMware vCenter connections, datacenters, folders, switch.
Configure iSCSI boot parameters.
Configure vNIC templates.
Create/modify/delete vNIC/vHBA placement.
Create/modify/delete Service Profile dynamic vNICs within a Service Profile.
Configure vNIC behavior policy when vNICs are not explicitly defined.
Create/modify/delete Network Control policies.
Configure Ethernet server ports on the Fabric Interconnect.
Configure LAN connectivity policies. Configure Service Profile vNICs and add/remove VLANs on vNICs.
Reset IO Module and FEX. Set IO Module/FEX labels.
Create/modify/delete Ethernet adapter policies (Ethernet and iSCSI).
Configure Inband CIMC IP connectivity.
This privilege allows a user to configure network policies and network elements that are applied to service profile vNICs.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Create/modify/delete vNIC/vHBA placement.
Create/modify/delete Service Profile dynamic vNICs within a Service Profile.
Configure pools of IP addresses.
Create/modify/delete Network Control policies.
Configure Ethernet server ports on the Fabric Interconnect.
Specify the allowed range for virtual MAC addresses.
Configure pools of MAC addresses.
Create/modify/delete Service Profile dynamic vNIC policies.
Reset IO Module and FEX. Set IO Module/FEX labels.
Configure VMQ policies.
Service Profile QOS policy
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Create/modify/delete QoS rate-limiting and Flow Control policies.
This privilege allows a user to configure IPMI policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
All tasks inherited from privilege: ls-security-policy
This privilege allows a user to configure IPMI policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure IPMI users and IPMI authentication profiles.
This privilege allows a user to configure service profiles.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure Service Profile vNICs storage initiator autoconfig policies.
Create/modify/delete local storage policies (disks and LUNs).
Associate and Disassociate Service Profiles.
Configure FC group templates.
Configure Storage Profiles. Assign storage profiles to Service Profiles.
Configure Service Profile iSCSI vNICs.
Create/modify/delete Service Profiles/Templates. Assign policies to Service Profiles. Acknowledge service profile pending tasks.
Configure VMQ policies.
Configure schedules. Schedules can be used to trigger one-time or periodic tasks in the future.
Configure iSCSI boot parameters.
Configure Service Profile scriptable vMedia.
Create/modify/delete Service Profile maintenance policies.
Create/modify/delete Service Profile dynamic vNICs within a Service Profile.
Assign storage profiles to Service Profiles.
Configure vNIC behavior policy when vNICs are not explicitly defined.
Configure the vNIC/vHBA placement of a Service Profile.
Configure SAN connectivity policies. Configure Service Profile vHBAs and add/remove VSANs on vHBAs.
Configure LAN connectivity policies. Configure Service Profile vNICs and add/remove VLANs on vNICs.
Within a service profile, specify if vNICs/vHBAs should be inherited from the hardware when vNICs/vHBAs are not explicitly defined.
Configure vHBA behavior policy when vHBAs are not explicitly defined.
Configure power policies and power placement.
Perform maintenance tasks on local disks, local LUNs and remote LUNs.
Configure Service Profile scriptable vMedia policies.
Configure Inband CIMC IP connectivity.
Configure Service Profile BIOS policies.
This privilege allows a user to control the power state of a service profile.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Control the power state of a Service Profile.
This privilege allows a user to control the power state of a service profile, associate and disassociate service profiles, and configure server-related policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure Service Profile boot policies.
Configure Service Profile vNICs storage initiator autoconfig policies.
Control the power state of a Service Profile.
Create/modify/delete server-related policies: maintenance, BIOS.
Associate and Disassociate Service Profiles.
Create/modify/delete FC adapter policies.
Create/modify/delete management firmware packages. This feature is deprecated.
Configure iSCSI authentication profile.
Configure DIMM black listing policy.
Configure Service Profile scriptable vMedia.
Create/modify/delete host firmware packages.
Create/modify/delete vNIC/vHBA placement.
Configure power policies and power placement.
Configure Service Profile scriptable vMedia policies.
Create/modify/delete Ethernet adapter policies (Ethernet and iSCSI).
This privilege allows a user to configure storage policies and storage elements that are applied to service profile vHBAs. The user can also configure other storage elements that impact service profiles.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure Service Profile vNICs storage initiator autoconfig policies.
Create/modify/delete local storage policies (disks and LUNs).
Configure the FC storage visibility for a vHBA initiator group.
Configure the allowed range for UUIDs.
Create/modify/delete FC adapter policies.
Configure FC group templates.
Configure Storage Profiles. Assign storage profiles to Service Profiles.
Configure Service Profile iSCSI vNICs.
Create/modify/delete storage connection policies.
Configure the allowed range for virtual WWN addresses.
Configure vHBA initiator groups.
Configure Service Profile scriptable vMedia.
Configure iSCSI boot parameters.
Assign storage profiles to Service Profiles.
Configure vHBA behavior policy when vHBAs are not explicitly defined.
Perform maintenance tasks on local disks, local LUNs and remote LUNs.
Configure Service Profile scriptable vMedia policies.
Set FC zone labels.
This privilege allows a user to configure storage policies and storage elements that are applied to service profile vHBAs.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure Service Profile boot policies.
Configure Service Profile vNICs storage initiator autoconfig policies.
Create/modify/delete local storage policies (disks and LUNs).
Configure the allowed range for UUIDs.
Configure FC group templates.
Configure pools of WWN addresses.
Configure storage connection within a Service Profile.
Configure Storage Profiles. Assign storage profiles to Service Profiles.
Create/modify/delete storage connection policies.
Configure pools of IQN addresses (for iSCSI).
Configure the allowed range for virtual WWN addresses.
Configure Service Profile scriptable vMedia.
Create/modify/delete vNIC/vHBA placement.
Assign storage profiles to Service Profiles.
Configure Service Profile scriptable vMedia policies.
This privilege allows a user to perform maintenance activities, such as SEL backup operations, and to configure system-level policies, such as call home, syslog, and log level, and to create tech support files.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure log file export policies. Export log files.
Configure the logging level for debug log files on the Fabric Interconnect.
Configure the Catalog pack, specifying which catalog to be used.
Configure the Syslog feature.
Clear or backup SEL log files (FEX, IO Module, CIMC). Configure SEL log policy.
Configure the statistics collection policies.
Acknowledge faults.
Create/modify/delete stats threshold policies.
Configure whether config, firmware and monitoring policies are resolved locally or through UCS Central.
Configure core file export policies. Download core files.
Generate and download Tech Support files.
This privilege allows a user to configure organizations in the org hierarchy.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Create/modify/delete organizations.
This privilege allows a user to configure the power supply redundancy policy and to control the power state of network adapters.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Control power state of network adaptors.
Configure Power Supply Redundancy policy. Configure whether PSU redundancy policies can be resolved through UCS Central.
This privilege allows a user to perform maintenance operations on physical servers, such as acknowledging servers, configuring locator LEDs, and decommissioning servers.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Control the power state of a Service Profile.
Configure diagnostics.
Enable/Disable Ethernet/FC/iSCSI ports and port channels on a server adapter. Set port/port channel label.
Enable/Disable mapping out of black-listed DIMMs. Reset server DIMM errors.
Configure locator, indicator, beacon and health LEDs.
Perform server maintenance operations: reset CIMC, reset KVM server, reset CMOS, perform diagnostic interrupt, reset server. Set blade and rack server labels.
Reset IO Module and FEX. Set IO Module/FEX labels.
Create/modify/delete chassis pack.
Acknowledge, decommission, recommission and recover blade servers and rack servers.
Acknowledge Chassis and IO Module. Set Chassis labels and chassis IDs.
Enable/Disable Ethernet ports on a Fabric Interconnect or IO Module. Set port labels.
This privilege allows a user to configure server-related policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Control power state of network adaptors.
Configure Power Supply Redundancy policy. Configure whether PSU redundancy policies can be resolved through UCS Central.
Control the power state of a Service Profile.
Assign port profiles to Distributed Virtual Switches.
Configure server/chassis discovery, acknowledgement and connectivity policies. Configure blade inheritance and auto-configuration policy.
Configure Virtual Machine and Virtual Machine vNIC retention policy.
Configure locator, indicator, beacon and health LEDs.
Configure VMware vCenter cryptographic keys.
Perform server maintenance operations: reset CIMC, reset KVM server, reset CMOS, perform diagnostic interrupt, reset server. Set blade and rack server labels.
Create/modify/delete chassis pack.
Acknowledge, decommission, recommission and recover blade servers and rack servers.
Configure UUID pools.
Configure VMware vCenter connections, datacenters, folders, switch.
Configure DIMM black listing policy.
Configure whether server/chassis discovery policies can be resolved through UCS Central.
Run diagnostics.
Configure Service Profile disk and BIOS scrub policies.
Enable/Disable mapping out of black-listed DIMMs. Reset server DIMM errors.
Configure server pools, server pool policies, and server pool qualification policies.
Reset IO Module and FEX. Set IO Module/FEX labels.
Acknowledge Chassis and IO Module. Set Chassis labels and chassis IDs.
Configure Service Profile BIOS policies.
This privilege is currently not used.
This privilege allows a user to configure power groups, the power budget, and power policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
Configure Power Groups, power budget, and power policies.