Ah, excellent catch. That's it. We recently enabled TACACS authentication on the non-working device and apparently we need to tweak the roles. I am only in as "Network Monitor":
dc4pt-lb-01/Admin# sh role
Role: Network-Monitor (System-defined)
Description: Monitoring for all features
Number of rules: 5
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Monitor all
2. Permit Monitor changeto
3. Deny Create exec-commands
4. Deny Create fault-tolerance
5. Deny Create pki
dc4pt-lb-01/Admin#
In my other devices I have all permissions:
dc4-lb-01/Admin# sh role
Role: Admin (System-defined)
Description: Administrator
Number of rules: 5
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Create all
2. Permit Create user access
3. Permit Create system
4. Permit Create changeto
5. Permit Create exec-commands
Role: Network-Admin (System-defined)
Description: Admin for L3 (IP and Routes) and L4 VIPs
Number of rules: 8
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Create interface
2. Permit Create routing
3. Permit Create connection
4. Permit Create nat
5. Permit Create vip
6. Permit Create config_copy
7. Permit Create changeto
8. Permit Create exec-commands
Role: Server-Maintenance (System-defined)
Description: Server maintenance, monitoring and debugging
Number of rules: 7
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Modify real
2. Permit Debug serverfarm
3. Permit Debug vip
4. Permit Debug probe
5. Permit Debug loadbalance
6. Permit Create changeto
7. Permit Create exec-commands
Role: Server-Appln-Maintenance (System-defined)
Description: Server maintenance and L7 policy application
Number of rules: 7
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Create real
2. Permit Create serverfarm
3. Permit Create loadbalance
4. Permit Create config_copy
5. Permit Create real-inservice
6. Permit Create exec-commands
7. Permit Create changeto
Role: SLB-Admin (System-defined)
Description: Administrator for all load-balancing features
Number of rules: 11
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Create real
2. Permit Create serverfarm
3. Permit Create vip
4. Permit Create probe
5. Permit Create loadbalance
6. Permit Create nat
7. Permit Modify interface
8. Permit Create config_copy
9. Permit Create exec-commands
10. Permit Create real-inservice
11. Permit Create changeto
Role: Security-Admin (System-defined)
Description: Administrator for all security features
Number of rules: 9
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Create access-list
2. Permit Create inspect
3. Permit Create connection
4. Permit Modify interface
5. Permit Create AAA
6. Permit Create nat
7. Permit Create config_copy
8. Permit Create changeto
9. Permit Create exec-commands
Role: SSL-Admin (System-defined)
Description: Administrator for all SSL features
Number of rules: 6
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Create ssl
2. Permit Create pki
3. Permit Modify interface
4. Permit Create config_copy
5. Permit Create changeto
6. Permit Create exec-commands
Role: Network-Monitor (System-defined)
Description: Monitoring for all features
Number of rules: 5
---------------------------------------------
Rule Type Permission Feature
---------------------------------------------
1. Permit Monitor all
2. Permit Monitor changeto
3. Deny Create exec-commands
4. Deny Create fault-tolerance
5. Deny Create pki
dc4-lb-01/Admin#
