Cisco MDS 9000 Series Configuration Manual page 31

Common Roles
For example, if user A is permitted to perform all show commands, user A cannot view the output of the show
role command if user A does not belong to the network-admin role.
The rule command specifies operations that can be performed by a specific role. Each rule consists of a rule
number, a rule type (permit or deny), a command type (for example, config, clear, show, exec, debug), and
an optional feature name (for example, FSPF, zone, VSAN, fcping, or interface).
Note In this case, exec refer to all commands in the EXEC mode that are not included in the show, debug, and
clear command categories.
In cases where a default role is applicable to all users, and a configured role is applicable for specific users,
consider the following scenarios:
• Same rule type (permit or deny)—If the default role and the configured role for a specific user have the
same rule type, then the specific user will have access to all the rules of both the default role and the
configured role.
If the default role, say A, has the following rules:
rule 5 permit show feature environment
rule 4 permit show feature hardware
rule 3 permit config feature ssh
rule 2 permit config feature ntp
rule 1 permit config feature tacacs+
And, a specific user is assigned to the following role, say B, with one rule:
rule 1 permit config feature dpvm
The specific user will have access to the rules of both A and B.
• Different rule type—If the default role and the configured role for a specific user have different rule
types for a particular rule, then the default role will override the conflicting rule statement of the configured
role.
If the default role, say A, has the following rules:
rule 5 permit show feature environment
rule 4 permit show feature hardware
rule 3 permit config feature ssh
rule 2 permit config feature ntp
rule 1 permit config feature tacacs+
And, a specific user is assigned to the following role, say B, with two rules:
rule 6 permit config feature dpvm
rule 2 deny config feature ntp
Rule 2 of A and B are in conflict. In this case, A overrides the conflicting rule of B, and the user is
assigned with the remaining rules of A and B, including the overridden rule:
rule 6 permit config feature dpvm
rule 5 permit show feature environment
rule 4 permit show feature hardware
rule 3 permit config feature ssh
rule 2 permit config feature ntp -----------> Overridden rule
rule 1 permit config feature tacacs+
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Configuring Rules and Features for Each Role
13