Privileges for Role-Based Access

Role-based access privileges are arranged into five categories, which are called tasks:

• Interface—Privileges for controlling the interfaces on the Cisco IOS XE Catalyst SD-WAN device.

• Policy—Privileges for controlling the control plane policy, OMP, and data plane policy.

• Routing—Privileges for controlling the routing protocols, including BFD, BGP, OMP, and OSPF.

• Security—Privileges for controlling the security of the device, including installing software and certificates. Only users belonging to the netadmin group can install software on the system.

• System—General system-wide privileges.

The Cisco Catalyst SD-WAN AAA software implements role-based access to control the authorization permissions for users on Cisco IOS XE Catalyst SD-WAN devices. Role-based access consists of three components:

• Users are those who are allowed to log in to a Cisco IOS XE Catalyst SD-WAN device.

• User groups are collections of users.

• Privileges are associated with each group. They define the commands that the group's users are authorized to issue.

Users and User Groups

All users who are permitted to perform operations on a Cisco IOS XE Catalyst SD-WAN device must have a login account. For the login account, you configure a username and a password on the device itself. These allow the user to log in to that device. A username and password must be configured on each device that a user is allowed to access.

The Cisco Catalyst SD-WAN software provides one standard username, admin, which is a user who has full administrative privileges, similar to a UNIX superuser. By default, the admin username password is admin. You cannot delete or modify this username, but you can and should change the default password.

User groups pool together users who have common roles, or privileges, on the Cisco IOS XE Catalyst SD-WAN device. As part of configuring the login account information, you specify which user group or groups that user is a member of. You do not need to specify a group for the admin user, because this user is automatically in the user group netadmin​ and is permitted to perform all operations on the Cisco IOS XE Catalyst SD-WAN device.

The user group itself is where you configure the privileges associated with that group. These privileges correspond to the specific commands that the user is permitted to execute, effectively defining the role-based access to the Cisco Catalyst SD-WAN software elements.

The Cisco Catalyst SD-WAN software provides the following standard user groups:

• basic: The basic group is a configurable group and can be used for any users and privilege levels. This group is designed to include users who have permission to both view and modify information on the device.

• operator: The operator group is also a configurable group and can be used for any users and privilege levels. This group is designed to include users who have permission only to view information.

• netadmin: The netadmin group is a non-configurable group. By default, this group includes the admin user. You can add other users to this group. Users in this group are permitted to perform all operations on the device.

• Minimum supported release: Cisco vManage Release 20.9.1

  network_operations: The network_operations group is a non-configurable group. Users in this group can perform all non-security-policy operations on the device and only view security policy information. For example, users can create or modify template configurations, manage disaster recovery, and create non-security policies such as application aware routing policy or CFlowD policy.

• Minimum supported release: Cisco vManage Release 20.9.1

  security_operations: The security_operations group is a non-configurable group. Users in this group can perform all security operations on the device and only view non-security-policy information. For example, users can manage umbrella keys, licensing, IPS signatures auto update, TLS/SSL proxy settings, and so on.

Users of the network_operations group are authorized to apply policies to a device, revoke applied policies, and edit device templates. Users of the security_operations group require network_operations users to intervene on day-0 to deploy security policy on a device and on day-N to remove a deployed security policy. However, after a security policy is deployed on a device, security_operations users can modify the security policy without needing the network_operations users to intervene.

Note

Only admin users can view running and local configuration. Users associated with predefined operator user group do not have access to the running and local configurations. The predefined user group operator has only read access for the template configuration. If you need only a subset of admin user privileges, then you need to create a new user group with the selected features from the features list with both read and write access and associate the group with the custom user.

Privileges for Role-Based Access

Role-based access privileges are arranged into five categories, which are called tasks:

• Interface—Privileges for controlling the interfaces on the Cisco IOS XE Catalyst SD-WAN device.

• Policy—Privileges for controlling control plane policy, OMP, and data plane policy.

• Routing—Privileges for controlling the routing protocols, including BFD, BGP, OMP, and OSPF.

• Security—Privileges for controlling the security of the device, including installing software and certificates. Only users belonging to the netadmin group can install software on the system.

• System—General systemwide privileges.

The tables in the following sections detail the AAA authorization rules for users and user groups. These authorization rules apply to commands issued from the CLI and to those issued from Netconf.

User Authorization Rules for Operational Commands

The user authorization rules for operational commands are based simply on the username. Any user who is allowed to log in to the Cisco IOS XE Catalyst SD-WAN device can execute most operational commands. However, only the admin user can issue commands that affect the fundamental operation of the device, such as installing and upgrading the software and shutting down the device.

Note that any user can issue the config command to enter configuration mode, and once in configuration mode, they are allowed to issue any general configuration command. Also, any user is allowed to configure their password by issuing the system aaa user self password password command and then committing that configuration change. For the actual commands that configure device operation, authorization is defined according to user group membership. See User Group Authorization Rules for Configuration Commands.

The following tables lists the AAA authorization rules for general CLI commands. All the commands are operational commands except as noted. Also, some commands available to the "admin" user are available only if that user is in the "netadmin" user group.

User Group Authorization Rules for Operational Commands

The following table lists the user group authorization roles for operational commands.

User Group Authorization Rules for Configuration Commands

The following table lists the user group authorization rules for configuration commands.

Global Admin

User accounts in the global resource group have access to all resources. A global admin is responsible for overseeing the entire network, but not involved in the operations of the individual devices on a daily basis. The global admin can assign devices to their corresponding regions, assign the regional admin accounts, manage the controllers, maintain sharable and centralized configurations, and when necessary, operate on the individual devices.

Any user in a single tenant setup with netadmin privileges and also part of global resource group is considered as global admin. Default admin user on Cisco SD-WAN Manager is also a global-admin, and that user can assign more global-admins. Global resource group encompasses all the WAN edges, controllers in the single view.

Global admin can switch to view only a specific resource group and can create templates. Local resource group admins, also called regional admins can clone the global templates and reuse them within their resource groups.

Regional Admin

The regional admins are responsible for day-to-day operations (configuration, monitoring, onboarding, and so on) for devices in their corresponding regions. They should not have access to or visibility into devices outside of their region. The following user groups can be created:

• resource group admin – full read/write access to devices in the corresponding resource group, can troubleshoot, monitor, attach or detach templates for the WAN edges in their group

• resource group operator – read-only access to WAN edges within their resource group

• resource group basic – basic access

Resource group admins can create new templates and attach or detach to the WAN edges in their group. They can also copy global templates and re-use them.

Resource group decides which resources the user has access to. However, the level of access is controlled by the existing user group.

• If user is in resource_group_a and user group resource_group_admin, they have full read/write access to all resources in resource_group_a.

• If user is in resource_group_a and user group resource_group_operator, they have read only access to all resources in resource_group_a.

• If user is in resource_group_a and user group resource_group_basic, they have read only access to interface and system resources in resource_group_a.

Global Resource Group

Global group is a special system pre-defined resource group that has different access control rules.

• Users within this group are considered as global-admins, who can have full access to all resources (devices, templates and policies) in the system and they can manage the resource groups and assign resources and users to groups.

• All other users have read-only access to resources within this group.

• The system default admin account (or tenantadmin account in a multi-tenant setup) is always in this group. This privilege cannot be changed. However, the admin account may add/remove other user accounts to or from this group.

IdP (SSO)-Managed Group

An identity provider (IdP) is a service that stores and verifies user identity. IdPs typically work with single sign-on (SSO) providers to authenticate users. If a user is authenticated with a SSO service of an IdP, the group information is also provided and managed by the IDP. An IdP passes the information about the user, including the user name and all the group names, where the user belongs to. Cisco SD-WAN Manager matches the group names with the group names stored in the database to further distinguish if a particular group name passed from IdP is for user group or resource group or VPN group.

Multi-Tenancy Support

With Cisco Catalyst SD-WAN multitenancy, a service provider can manage multiple customers, called tenants, from Cisco SD-WAN Manager. The tenants share Cisco SD-WAN Manager instances, Cisco SD-WAN Validator, and Cisco SD-WAN Controller. The domain name of the service provider has subdomains for each tenant. Cisco SD-WAN Manager is deployed and configured by the service provider. The provider enables multitenancy and creates a Cisco SD-WAN Manager cluster to serve tenants. Only the provider can access a Cisco SD-WAN Manager instance through the SSH terminal.

Provider has the following features:

• resource group is not applicable as the provider manages only the controllers.

• when provider provisions a new tenant, the default user account for the tenant is tenantadmin.

• other user accounts created by the provider are included in the default global resource group.

• when a provider creates a template for a tenant, the template is included in to the global resource group.

Single-Tenant and Multi-Tenant Scenarios

You can use granular RBAC for feature templates in single-tenant and multi-tenant Cisco SD-WAN Manager scenarios.

You can create user groups to assign specific permissions to a tenant's various teams, enabling teams to manage only specific network services without granting permission to use device CLI templates. It might be undesirable to give a tenant permission to apply device CLI templates, as the device CLI template can override any other template or device configuration.

For example, you can create a user group for a tenant's security operations group, giving them read/write access only to the SIG Template option, which would enable the security operations group to work on security configuration.

1. From the Cisco SD-WAN Manager menu, choose Administration > Users and Access.

   By default Scope menu is selected. The table displays the list of scopes configured in the device.

2. Click Add Scope.

3. Enter Scope Name and Description.

4. Click Add Nodes.

5. Choose the required Nodes and click Save.

   (Optional) Click Edit Nodes to update the existing nodes in the list.

6. (Optional) In the Associations pane, click Add Users to associate users.

7. In the Add Users pop-up window, choose the users that you want to add.

8. Click Save.

   The selected users are associated to a scope.

9. (Optional) In the Configurations tab, click Add Configurations to add configurations.

10. In the Add Configurations page, choose the available configurations from the following tabs:

    1. Configuration Group

    2. Device Template

    3. Feature Template

    4. Feature Profile

    5. Security Policy

    6. Localized Policy

11. Click Save.

    A new scope with nodes, users and required configurations is created.

1. From the Cisco SD-WAN Manager menu, choose Administration > Users and Access.

   By default Roles menu is selected. The table displays the list of scopes configured in the device.

2. Click Add Role.

3. Enter Custom Role Name in the Add Custom Role page.

4. Select the Deny, Read, or Write check box against the feature or sub feature that you want to assign a role.

5. Click Add.

6. You can view the new role in the table in the Roles page.

Copy Custom Role

1. In the list of roles, for the role you wish to copy, click ..., and click Copy.

   The Copy Custom Role page is displayed.

2. Enter Custom Role Name.

3. Select the Deny, Read, or Write check box against the feature or sub feature that you want to update for a role.

4. Click Copy.

5. You can view the new role in the table in the Roles page.

Edit Custom Role

1. In the list of roles, for the role you wish to copy, click ..., and click Edit.

   The Edit Custom Role page is displayed.

2. Select the Deny, Read, or Write check box against the feature or sub feature that you want to update for a role.

3. Click Update.

4. You can view the updated role in the table in the Roles page.

Delete a Role

You can delete a role when it is no longer needed. For example, you might delete a role that you created for a specific project when that project ends.

1. Choose the role you wish to delete, click ..., and click delete.

   The Warning page is displayed.

2. To confirm the deletion of the role, click Delete.

Add User

1. From the Cisco SD-WAN Manager menu, choose Administration > Users and Access.

2. Click Users.

3. Click Add User.

4. Configure the following:

   Field	Description
   Full Name	Enter the full name of the user.
   User Name	Enter the user name.
   Password	Enter a password.
   Remote User	Enable the Remote User option for remote users. If you enable this option, enter an email for the user.
   Roles	Choose roles for the user.
   Scope	Choose the scope for the user.
   Select Locale	(Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.13.1) Choose a locale to set the language for the Cisco SD-WAN Manager user interface.

   Note	In Cisco Catalyst SD-WAN Manager Release 20.12.1 and earlier releases, Cisco SD-WAN Manager only supported the English language on the user interface. From Cisco Catalyst SD-WAN Manager Release 20.13.1, Cisco SD-WAN Manager user interface supports Canadian French.

5. Click Add to add the user.

Edit User

1. In the Users page, for the user you wish to edit, click ..., and click Edit.

   The Edit User page is displayed.

2. Enter Full Name, User Name.

3. Choose the role from the Roles drop-down list.

4. Choose the scope from the Scope drop-down list.

5. (Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.13.1) Choose the locale from the Select Locale drop-down list.

6. Click Update.

Copy User

1. For the user you wish to copy, click ..., and click Copy.

   The Copy User page is displayed.

2. Enter Full Name, User Name.

3. Enter the password in the Password and Confirm Passwordfields.

4. Choose the role from the Roles drop-down list.

5. Choose the scope from the Scope drop-down list.

6. (Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.13.1) Choose the locale from the Select Locale drop-down list.

7. Click Copy.

Delete User

If a user no longer needs access to devices, you can delete the user. Deleting a user does not log out the user if the user is logged in.

1. For the user you wish to delete, click ..., and click Delete.

2. To confirm the deletion of the user, click OK.

Change User Password

1. For the user you wish to change the password, click ... and click Change Password.

2. Enter the Current User Password.

3. Enter the new password in the Password field.

4. Enter the new password again in the Confirm Password field.

5. Click Update.

Reset Locked User

1. For the user you wish to reset the lock, click ... and click Reset Locked User.

2. In the Reset Locked User pop-up menu, click Yes.

Administrative Lock

1. For the user you wish to reset the lock, click ... and click Administrative Lock.

2. In the Lock User pop-up menu, click Yes.