Configuring Feature Groups; Changing Resource Access Policies - HP 10500 Series Configuration Manual

Step
3. Configure a rule.

Configuring feature groups

Use feature groups to bulk assign command access permissions to sets of features. In addition to the
predefined feature groups, you can create up to 64 custom feature groups and assign a feature to
multiple feature groups.
To configure a feature group:
Step
1. Enter system view.
2. Create a feature group
and enter feature group
view.
3. Add a feature to the
feature group.

Changing resource access policies

Every user role has one interface policy, VLAN policy, and VPN instance policy. By default, these policies
permit user roles to access any interface, VLAN, and VPN. You can change the policies of user-defined
user roles and the predefined level-n user roles to limit their access to interfaces, VLANs, and VPNs. A
changed policy takes effect only on users who are logged in with the user role after the change.
Command
•
Configure a command rule:
rule number { deny | permit }
command command-string
•
Configure a feature rule:
rule number { deny | permit }
{ execute | read | write } * feature
[ feature-name ]
•
Configure a feature group rule:
rule number { deny | permit }
{ execute | read | write } *
feature-group feature-group-name
Command
system-view
role feature-group name
feature-group-name
feature feature-name
57
Remarks
Configure at least one command.
By default, a user-defined user role
has no rules or access to any
command.
Repeat this step to add up to 256
rules to the user role.
IMPORTANT:
When you configure feature rules,
you can specify only features
available in the system and must
enter feature names exactly the same
as they are displayed, including the
case.
Remarks
N/A
By default, the system has the following
predefined feature groups:
•
L2—Includes all Layer 2 commands.
•
L3—Includes all Layer 3 commands.
These two groups are not user configurable.
By default, a feature group has no features.
IMPORTANT:
You can specify only features available in
the system and must enter feature names
exactly the same as they are displayed,
including the case.