
ii
Configuration procedures·························································································································37
Configuration example ·····························································································································37
Controlling SNMP access ································································································································38
Configuration procedure···························································································································38
Configuration example ·····························································································································39
Configuring command authorization ················································································································40
Configuration procedure···························································································································40
Configuration example ·····························································································································41
Configuring RBAC························································································· 45
Overview ··························································································································································45
Permission assignment ····························································································································45
Assigning user roles·································································································································47
FIPS compliance··············································································································································48
Configuration task list·······································································································································48
Creating user roles···········································································································································48
Configuring user role rules·······························································································································49
Configuration restrictions and guidelines ·································································································49
Configuration procedure···························································································································49
Configuring feature groups ······························································································································50
Configuring resource access policies ··············································································································50
Configuring the user role interface policy·································································································51
Configuring the user role VLAN policy ·····································································································51
Configuring the user role VPN instance policy·························································································51
Assigning user roles·········································································································································52
Enabling the default user role feature ······································································································52
Assigning user roles to remote AAA authentication users ·······································································52
Assigning user roles to local AAA authentication users ···········································································53
Assigning user roles to non-AAA authentication users on user lines·······················································53
Configuring temporary user role authorization·································································································54
Configuration guidelines···························································································································54
Configuring user role authentication ········································································································55
Obtaining temporary user role authorization ····························································································56
Displaying and maintaining RBAC settings······································································································56
RBAC configuration examples ·························································································································56
RBAC configuration example for local AAA authentication users ····························································56
RBAC configuration example for RADIUS authentication users ······························································58
RBAC configuration example for HWTACACS authentication users ·······················································61
Troubleshooting RBAC ····································································································································64
Local users have more access permissions than intended······································································64
Login attempts by RADIUS users always fail···························································································65
Configuring FTP···························································································· 66
FIPS compliance··············································································································································66
Using the device as an FTP server··················································································································66
Configuring basic parameters ··················································································································66
Configuring authentication and authorization···························································································67
Manually releasing FTP connections ·······································································································67
Displaying and maintaining the FTP server ·····························································································68
FTP server configuration example in standalone mode···········································································68
FTP server configuration example in IRF mode·······················································································69
Using the device as an FTP client ···················································································································71
Establishing an FTP connection···············································································································71
Managing directories on the FTP server ··································································································72
Working with files on the FTP server ·······································································································72
Changing to another user account ···········································································································73
Maintaining and troubleshooting the FTP connection ··············································································73
Terminating the FTP connection ··············································································································74
Displaying command help information ·····································································································74
Displaying and maintaining FTP client·············································································································74
FTP client configuration example in standalone mode ····················································································74
FTP client configuration example in IRF mode ································································································76