50
{ If the user passes local authorization, the device assigns the user roles specified in the local user
account.
{ If the user passes remote authorization, the remote AAA server assigns the user roles specified
on the server. The AAA server can be a RADIUS or HWTACACS server.
• Non-AAA authorization—When the user accesses the device without authentication or by passing
password authentication, the device assigns user roles specified on the user line. This method also
applies to SSH clients that use publickey or password-publickey authentication. User roles assigned
to these SSH clients are specified in their respective local device management user accounts.
For more information about AAA and SSH, see Security Configuration Guide. For more information
about user line, see "Login overview" and "Logging in to the CLI."
FIPS compliance
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features,
commands, and parameters might differ in FIPS mode and non-FIPS mode. For more information about
FIPS mode, see Security Configuration Guide.
Configuration task list
Tasks at a glance
(Required.) Creating user roles
(Required.) Configuring user role rules
(Optional.) Configuring feature groups
(Optional.) Changing resource access policies
(Optional.) Assigning user roles
(Optional.) Configuring temporary user role authorization
Creating user roles
In addition to the predefined user roles, you can create up to 64 custom user roles for granular access
control.
To create a user role:
Ste
Command
Remarks
1. Enter system view.
system-view N/A
To Next Page
Loading...
Need help?
General
