Privileges in Cisco UCS, Release 2.1
Available Languages
Table Of Contents
Privileges in Cisco UCS, Release 2.1
Role-Based Access Control and Privileges
Tasks Allowed with this Privilege
Tasks Allowed with this Privilege
Ext Lan Config (ext-lan-config)
Tasks Allowed with this Privilege
Ext Lan Policy (ext-lan-policy)
Tasks Allowed with this Privilege
Tasks Allowed with this Privilege
Ext Lan Security (ext-lan-security)
Tasks Allowed with this Privilege
Ext San Config (ext-san-config)
Tasks Allowed with this Privilege
Ext San Policy (ext-san-policy)
Tasks Allowed with this Privilege
Tasks Allowed with this Privilege
Tasks Allowed with this Privilege
Service Profile Compute (ls-compute)
Tasks Allowed with this Privilege
Service Profile Config (ls-config)
Tasks Allowed with this Privilege
Service Profile Config Policy (ls-config-policy)
Tasks Allowed with this Privilege
Service Profile Network (ls-network)
Tasks Allowed with this Privilege
Service Profile Network Policy (ls-network-policy)
Tasks Allowed with this Privilege
Service Profile Qos Policy (ls-qos-policy)
Tasks Allowed with this Privilege
Service Profile Security (ls-security)
Tasks Allowed with this Privilege
Service Profile Security Policy (ls-security-policy)
Tasks Allowed with this Privilege
Service Profile Server (ls-server)
Tasks Allowed with this Privilege
Service Profile Server Oper (ls-server-oper)
Tasks Allowed with this Privilege
Service Profile Server Policy (ls-server-policy)
Tasks Allowed with this Privilege
Service Profile Storage (ls-storage)
Tasks Allowed with this Privilege
Service Profile Storage Policy (ls-storage-policy)
Tasks Allowed with this Privilege
Tasks Allowed with this Privilege
Org Management (org-management)
Tasks Allowed with this Privilege
Server Equipment (pn-equipment)
Tasks Allowed with this Privilege
Server Maintenance (pn-maintenance)
Tasks Allowed with this Privilege
Tasks Allowed with this Privilege
Tasks Allowed with this Privilege
Effects of Upgrading and Downgrading
Effect of Upgrading on Roles and Privileges
Effect of Downgrading on the New Role
Effect of Downgrading on Users Assigned the New Privileges
Effect of Upgrading Back to Cisco UCS, Release 2.1 After a Downgrade
Obtaining Documentation and Submitting a Service Request
Privileges in Cisco UCS, Release 2.1
First Published: November 16, 2012Last Updated: November 16, 2012Part Number: OL-28363-01This document includes the following sections which describe the privileges in Cisco UCS, Release 2.(1):
•
Role-Based Access Control and Privileges
•
Role-Based Access Control and Privileges
Role-Based Access Control (RBAC) is a method of restricting or authorizing system access for users based on user roles and locales. A role defines the privileges of a user in the system and the locale defines the organizations (domains) that a user is allowed to access.
In Cisco UCS Manager, you do not directly assign privileges to users. Instead, you assign the roles, which contain one or more privileges, to the users. However, to understand which role to assign to a user, you need to know which system resources the privileges included in that role allow the user to access.
For example, in a company which is configured with locales for Engineering and Finance, a user who is assigned the Server Administrator role in the Engineering locale can update server configurations in the Engineering locale but cannot update server configurations in the Finance locale. If you want the user to be able to update server configurations in the Finance locale, you must assign that locale to the user as well.
Privileges
Aaa (aaa)
This privilege allows a user to perform provisioning operations related to Authentication, Authorization and Accounting. This includes managing users and roles, and configuring services that are exposed to the management interfaces.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
Admin (admin)
This privilege provides a user with full access to all operations in Cisco UCS Manager.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Ext Lan Config (ext-lan-config)
This privilege allows a user to configure LAN settings on a fabric interconnect, including Ethernet border ports, VLANs, LAN PIN groups, Ethernet SPAN sessions, LAN policies, and management interfaces.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
•
Ext Lan Policy (ext-lan-policy)
This privilege allows a user to configure LAN settings on a fabric interconnect, including Ethernet border ports, VLANs, LAN PIN groups, Ethernet SPAN sessions, LAN policies, and vNIC/vHBA placement policies
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
Ext Lan Qos (ext-lan-qos)
This privilege allows a user to configure QoS classes of service for Ethernet and Fibre Channel and to configure Ethernet MTU.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Ext Lan Security (ext-lan-security)
This privilege allows a user to configure NTP providers, and date and time zone settings.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Ext San Config (ext-san-config)
This privilege allows a user to configure SAN settings on a fabric interconnect, including FC/FCoE border ports, VSANs, SAN PIN groups, and Fibre Channel SPAN sessions.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Ext San Policy (ext-san-policy)
This privilege allows a user to configure SAN settings on a fabric interconnect, including FC/FCoE border ports, VSANs, SAN PIN Groups, and Fibre Channel SPAN sessions.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
Ext San Qos (ext-san-qos)
This privilege allows a user to configure QoS classes of service for Ethernet and Fibre Channel and to configure Ethernet MTU.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Fault (fault)
This privilege allows a user to configure fault policies, Call Home policies, and fault suppression policies. The user can also acknowledge faults in Cisco UCS Manager.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
Service Profile Compute (ls-compute)
This privilege allows a user to configure most aspects of service profiles. However the user cannot create, modify or delete vNICs or vHBAs. You can use this privilege to enforce a strong separation between server, network, and storage provisioning activities. For example, a network administrator can create vNICs, a storage administrator can create vHBAs, and the server administrator can configure all other elements of a service profile
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
Service Profile Config (ls-config)
This privilege allows a user to configure service profiles and to configure distributed virtual switches (DVSes) in a VM-FEX environment.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
Service Profile Config Policy (ls-config-policy)
This privilege allows a user to configure policies that are applied to Service Profiles, including host firmware packages, local disk policies, boot policies, and Serial over LAN policies
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
Service Profile Network (ls-network)
This privilege allows a user to configure network policies and network elements that are applied to service profile vNICs. A user can also configure other network elements that impact service profiles, such as server ports.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Service Profile Network Policy (ls-network-policy)
This privilege allows a user to configure network policies and network elements that are applied to service profile vNICs.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
Service Profile Qos Policy (ls-qos-policy)
This privilege allows a user to configure quality of service and flow control policies for service profiles.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
Service Profile Security (ls-security)
This privilege allows a user to configure IPMI policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Service Profile Security Policy (ls-security-policy)
This privilege allows a user to configure IPMI policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Service Profile Server (ls-server)
This privilege allows a user to configure service profiles.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Service Profile Server Oper (ls-server-oper)
This privilege allows a user to control the power state of a service profile.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Service Profile Server Policy (ls-server-policy)
This privilege allows a user to control the power state of a service profile, associate and disassociate service profiles, and configure server-related policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
Service Profile Storage (ls-storage)
This privilege allows a user to configure storage policies and storage elements that are applied to service profile vHBAs. The user can also configure other storage elements that impact service profiles.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
Service Profile Storage Policy (ls-storage-policy)
This privilege allows a user to configure storage policies and storage elements that are applied to service profile vHBAs.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
Operations (operations)
This privilege allows a user to perform maintenance activities, such as SEL backup operations, and to configure system-level policies, such as call home, syslog, and log level, and to create tech support files.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
Org Management (org-management)
This privilege allows a user to configure organizations in the org hierarchy.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Server Equipment (pn-equipment)
This privilege allows a user to configure the power supply redundancy policy and to control the power state of network adapters.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
Server Maintenance (pn-maintenance)
This privilege allows a user to perform maintenance operations on physical servers, such as acknowledging servers, configuring locator LEDs, and decommissioning servers.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
Server Policy (pn-policy)
This privilege allows a user to configure server-related policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Server Security (pn-security)
This privilege is currently not used.
Power Mgmt (power-mgmt)
This privilege allows a user to configure power groups, the power budget, and power policies.
Tasks Allowed with this Privilege
A user with this privilege can perform the following tasks:
•
Deprecated Privileges
The following privileges are not currently used by Cisco UCS Manager and may be deprecated in a future release:
•
•
•
•
•
•
•
Effects of Upgrading and Downgrading
This section describes the effects of upgrading to and downgrading from Cisco UCS, Release 2.1 on the new role and privileges introduced in this release.
•
•
•
•
Effect of Upgrading on Roles and Privileges
When you upgrade Cisco UCS Manager from an earlier release to Cisco UCS 2.1, the following occurs:
•
–
–
–
•
–
–
Effect of Downgrading on the New Role
If you downgrade Cisco UCS Manager from Cisco UCS, Release 2.1 to an earlier release, the following occurs:
•
•
•
Effect of Downgrading on Users Assigned the New Privileges
If you downgrade Cisco UCS Manager from Cisco UCS, Release 2.1 to an earlier release, the new privileges are not available in the downgraded Cisco UCS Manager. The following occurs to users who are assigned roles that include the new privileges:
•
•
Effect of Upgrading Back to Cisco UCS, Release 2.1 After a Downgrade
If you upgrade Cisco UCS Manager back to Cisco UCS, Release 2.1 after you have downgraded from that release, the following occurs to users who were assigned the new role or privileges:
•
•
•
Related Documentation
For more information, you can access related documents from the Cisco UCS Documentation Roadmap.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as an RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2012 Cisco Systems, Inc. All rights reserved.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)