You can restrict which VMware vCenter users or user groups have visibility into specific port groups on the Cisco Nexus 1000V.

Before you can restrict the visibility of a port group, the server administrator must define which VMware vCenter users and user groups have access to the Cisco Nexus 1000V DVS top level folder in VMware vCenter Server. Once this is done, the network administrator can further define the visibility of specific port groups on the VSM. This configuration on the VSM is then published to the VMware vCenter Server so that access to specific port groups is restricted.

You can save the time of defining access on the VSM per user by, instead, adding new users to groups in VMware vCenter where access is already defined. Group members defined in VMware vCenter automatically gain access to the port groups defined for the group.

You can see in the following figure the relationship between users and groups in vCenter Server and port profiles and port profile roles in Cisco Nexus 1000V.

Figure 1. Port Profile Visibility: User, Groups, Roles, and Port Profiles

• The server administrator does not propagate access from the DVS down to lower folders. Instead, port group access is defined by the network administrator on the VSM and then published to the VMware vCenter Server.
• The Cisco Nexus 1000V VSM must be connected to the VMware vCenter Server before port profile roles are created or assigned. If this connection is not in place when port profile visibility is updated on the VSM, it is not published to VMware vCenter Server and is not affected.
• The following are guidelines for port profile roles on the VSM:
  • You cannot remove a port profile role if a port profile is assigned to it. You must first remove the role from the port profile.
  • Multiple users and groups can be assigned to a role.
  • Only one role can be assigned to a port profile.
  • A role can be assigned to multiple port profiles.
• You can define up to 256 port-profile-roles per VSM.
• You can define a total of 16 users and groups per role.

1.    In the vSphere Client window, do the following:

2.    In the Select Users and Groups window, do the following:

3.    In the Assign Permission window, do the following:

Step 1	In the vSphere Client window, do the following: Choose Inventory > Networking. Choose Add Permission. Figure 2. vSphere Client Window
Step 2	In the Select Users and Groups window, do the following: Choose the name from the list of users and groups. Click Add. Click OK. Figure 3. Select Users and Groups Window
Step 3	In the Assign Permission window, do the following: From the Assigned Role selection list, choose a role for this user or group. Make sure that the Propagate to Child Objects check box is unchecked. Click OK. Figure 4. Assign Permissions Window The user is granted the same access to the DVS object. In the example shown, user Sean is granted read-only access to the DVS folder object and eventually the DVS object. Note    Do not propagate the role definition here. Specific port group access is configured on the VSM which is then pushed to vSphere Client.

The user may now access the top level Cisco Nexus 1000V DVS folder according to the assigned role.

Note	To restrict access to specific port groups, go to the Restricting Port Profile Visibility on the VSM.

1.    switch# configure terminal

2.    switch(config)# feature port-profile-role

3.    (Optional) switch(config)# show feature

4.    (Optional) switch(config)# copy running-config startup-config

switch# configure terminal
switch(config)# feature port-profile-role adminUser
switch(config)# show feature
Feature Name          Instance  State   
--------------------  --------  --------
dhcp-snooping         1         enabled 
http-server           1         enabled 
ippool                1         enabled 
lacp                  1         enabled 
lisp                  1         enabled 
lisphelper            1         enabled 
netflow               1         disabled
port-profile-roles    1         enabled 
private-vlan          1         disabled
sshServer             1         enabled 
tacacs                1         enabled 
telnetServer          1         enabled 
switch(config)# copy running-config startup-config

1.    switch# configure terminal

2.    switch(config)# port-profile-role role-name

3.    (Optional) switch(config-port-prof-role)# description role-description

4.    (Optional) switch(config-port-prof-role)# show port-profile-role users

5.    (Optional) Enter one or more user or group roles.

6.    switch(config-port-prof-role)# exit

7.    switch(config)# port-profile profile-name

8.    switch(config-port-prof)# assign port-profile-role role-name

9.    (Optional) switch(config-port-prof)# show port-profile-role [name role-name]

10.    (Optional) switch(config-port-prof)# copy running-config startup-config

switch# configure terminal
switch(config)# port-profile-role adminUser
switch(config-port-prof-role)# description adminOnly
switch(config-port-prof-role)# user hdbaar
switch(config-port-prof-role)# exit
switch(config)# port-profile allaccess2
switch(config-port-prof)# assign port-profile-role adminUser
switch(config-port-prof)# show port-profile-role name adminUser

Name: adminUser
Description: adminOnly
Users:
    hdbaar (user)
Assigned port-profiles:
    allaccess2
switch(config-port-prof)# copy running-config startup-config

1.    (Optional) switch# show port-profile-role [name role-name]

2.    switch# configure terminal

3.    switch(config)# port-profile [type {ethernet | vethernet}] name

4.    switch(config-port-prof)# no assign port-profile-role role-name

5.    switch(config-port-prof)# exit

6.    switch(config)# no port-profile-role role-name

7.    (Optional) switch# show port-profile-role [name role-name]

8.    (Optional) switch(config)# copy running-config startup-config

switch# show port-profile-role name adminUser
Name: adminUser
Description: adminOnly
Users:
    hdbaar (user)
Assigned port-profiles:
    allaccess2
switch# configure terminal
switch(config)# port-profile allaccess2
switch(config-port-prof)# no assign port-profile-role adminUser
switch(config-port-prof)# exit
switch(config)# no port-profile-role adminUser
switch(config)# show port-profile-role name adminUser
switch(config)# copy running-config startup-config
switch(config)#