Hi Will,
One of the most challenging problems in managing large networks is the complexity of security administration.
The ACE appliance allows you to determine the commands and resources available to each user through RBAC. In RBAC, users are associated with domains and roles.
A domain is a collection of physical and virtual network resources such as real servers and virtual servers.
User roles determine a user's privileges, such as the commands that the user can enter and the actions the user can perform in a particular context.
The ACE provides a number of predefined roles. In addition, administrators in any context can define new roles.
The ACE provides the following predefined roles, which you cannot delete or modify:
• Admin—If created in the Admin context, has complete access to, and control over, all contexts, domains, roles, users, resources, and objects in the entire ACE. If created in a user context, gives a user complete access to and control over all policies, roles, domains, server farms, real servers, and other objects in that context.
• Network Admin—Has complete access to and control over the following features:
– Interfaces
– Routing
– Connection parameters
– Network Address Translation (NAT)
– VIPs
– Copy configurations
– changeto command
• Network-Monitor—Has access to all show commands and to the changeto command. If you do not explicitly assign a role to a user with the username command, this is the default role.
• Security-Admin—Has complete access to and control over the following security-related features within a context:
– ACLs
– Application inspection
– Connection parameters
– Interfaces
– Authentication, authorization, and accounting (AAA)
– NAT
– Copy configurations
– changeto command
• Server-Appln-Maintenance—Has complete access to and control over the following features:
– Real servers
– Server farms
– Load balancing
– Copy configurations
– changeto command
• Server-Maintenance—Can perform real server maintenance, monitoring, and debugging for the following features:
– Real servers—Modify permission
– Server farms—Debug permission
– VIPs—Debug permission
– Probes—Debug permission
– Load balancing—Debug permission
– changeto command—Create permission
• SLB-Admin—Has complete access to and control over the following ACE features within a context:
– Real servers
– Server farms
– VIPs
– Probes
– Load balancing (Layer 3/4 and Layer 7)
– NAT
– Interfaces
– Copy configurations
– changeto command
• SSL-Admin—Can administer all SSL features:
– SSL—Create permission
– PKI—Create permission
– Interfaces—Modify permission
– Copy configurations—Create permission
– changeto command—Create permission
.....contd page 2
