All right, let's have some fun. We're going to log into manager here,
create ourselves a user, create ourselves a role, and maybe even add a scope in there,
and we're going to make sure that our permission sets work when we log in with that user.
So this is an opportunity for us to see what life is like when our
access to manager is restricted a little bit. So we're going to start by going to a part of the
UI that we haven't really gone to yet in this course, which is administration. So this is
where we can manage our users and our access. So I'm going to click this, and we're going to start
here on the roles tab. Now, right away we see the five different roles that we talked about earlier,
so I can click on one like basic. Actually, let's start with NetAdmin. So NetAdmin is
fairly straightforward. As we mentioned, it's write access to all of these. And so again,
we have write, read, and deny. Again, deny is different from read only because deny makes it
so I can't even see something. But with our NetAdmin, of course, we can do whatever we want,
which is exactly what we want to have happen if we're administrating the system. Operator,
Cisco uses this word a lot to represent like a NOC member, somebody who's taking a look at things
but not making any changes. So in terms of that, we would expect for it to be read only for pretty
much everything as well. Basic is where things start to get a little more interesting because
we see a lot of deny, but we do see that we can read interfaces and again, system information.
Now, what exactly does system mean? Well, it can be a little tricky sometimes for us to interpret
that. Cisco does have documentation that shows this, but we can also just log in with an operator
user and find out what classifies the system if that's what we need to find out. Now, network
operations and security operations, this is where things get really crazy because we are allowing
ourselves to make certain changes. So again, this is somebody on the network operation side, so they
can make changes to the audit log, cloud on-ramp, which is definitely a network concept, managing
our controller and edge certificates, a very important part of bringing the network online.
But then when it comes to things like, let's just see here, we scroll down a little ways to
something a little more, well, yeah, sure. Well, let's just take a look at some of this. So role-based
access control from a VPN perspective, we don't need our network operators to be managing the
users, managing the reporting that's happening in here. Routing and the SD-WAN portal, absolutely.
We don't need them accessing scope, which is part of role-based access control. We don't need them
being able to change the settings. Sure, if we can perform software upgrades, that's important.
And that's because again, controllers and edges, these software upgrades are a part of the network.
So this is where Cisco has created some things like this for us to use if it helps. The security
operation, same thing. Now we're going to see that we can write things like the audit log and such,
but that cloud on-ramp, which our network operations team had access to, we don't even see
because we're a member of the security operations team. So if some of these are like, hey, these are
close again, I kind of like this, but there's a few permissions that I'd want to change.
We have this action option over here where I can copy one of these and start to create one myself.
Or as we said, we can start from scratch. So I'm going to click add role here,
and I'm going to call this role CBTN-role and keep things simple here. So from here,
now we see that exact same format, except it's radio buttons. Everything defaults to deny.
So I'm going to have to go through and say that, yeah, I want access to alarms or whatnot.
So let's go ahead and just make a change to, let's say, device inventory. I want to be able
to see the device inventory and maybe software upgrades. Where did that go? As I scroll down,
we see software upgrades right here. I'm going to say write, and I'll just make it very simple.
We'll just add this role into our system. So at this point, we can take this role,
we could apply it to a user. We're going to have to create a user, of course, as part of that,
but let's go ahead and create a quick scope. Now, remember, I said that scope, the default here is
all, we have access to everything. We can see the users that apply the all scope, which is
our current users right now. So I'm going to add a scope. We'll call this CBTN-scope,
and I'm going to go to my add nodes here, and I can add nodes that I want to have access to.
So I could say, let's just say that we're only allowed to access site 12.
And so now I'm going to click save, and we'll click add.
All right, so now we've added a role, and we've added a scope. Let's go ahead and create a user.
So I'm going to come over to my user tab, and I see the two users that come default. We see
Cisco is an admin, as we said. Admin itself is a, it just doesn't have a role. It's sort of above
all of this. It's a super user, and so there's nothing we can do there by changing its role
or anything. So I'm going to click add user, full name. We're just going to give this a name. We'll
call this CBT tech, and then the username. We'll call this CBTN-user, and we got to give it a
password. I'm just going to call it CBTN-user again, just to keep it clear, and confirm that
password. And now for the roles and the scope. All right, so the roles again, we see all of the
basic ones. I'm going to pick my CBTN role. I'm going to pick my scope, and I'm going to click add.
So once this is done, we actually have created our local user that I can log in with. So let's
go ahead and log out of the system. So I'm going to click log out here, and this is where it does
get pretty fun and interesting, is now I can log in with my CBT, not dash role, dash user.
And we're going to find out that this user interface looks very different compared to what
we're used to. And the reason for that is because we're heavily restricted with what this user is
allowed to do. So a couple of things. First of all, we'll close that out. Notice my control
components. Yeah, I can see the manager, but I can't see the validator or controller.
It's not part of my framework. WAN edges, why is there only one reachable? Why is there only
WAN edges? Why is there only one reachable? Well, because I only allowed myself to see devices
at site 12. And so there's a lot more restrictions all of a sudden. Look at the left here. A lot of
options are missing. And if I hover over like configuration, there's only so many things I can
do. Now, Cisco does not get rid of the categories. I can see the cloud on ramp and certificates and
classic categories, but there's no options in here that I can click on. So I'm very heavily
limited with what I can do. So I can go to WAN edges here and I can see the device inventory
here. I can see this edge because remember, I enabled a read-only access to the device inventory.
Now, the other permission that we gave ourselves is to do software upgrades. So I can go to
maintenance and I can see that I can do a software upgrade if I so desire. But of course, I can only
do a software upgrade to edge 12. So we have some pretty powerful methods for being as granular as
we need to be to give a particular user access to only the things that they need access to while
making it so that we can also give access to, you know, just users of all levels, whether you're on
the NOC, whether you're a network admin, whether you're an intern on our team, either way, we can
give access and restrict that access using the roles for permissions as well as filtering
out different sites and different devices thanks to the scope.