Using NCM as a "looking glass" for end users

We are trying to figure out a way to set up a generic account in NCM for our customers that only allows the user to execute a few select show commands (sho ip bgp summary, etc) on 2 nodes on our network. The built in user levels in NCM are not granular enough to limit the Configuration Management view to only show the "Execute Script" and "Transfer Status"Tasks. Also in the Execute Script window, is there a way to only show a list of scripts available to the user, and block access to load/save/download scripts?

Find more posts tagged with

web_console

network_configuration_manager

ncm_role

Accepted answers

All comments

cvachovecj

Hi Ron,

As you said, such details cannot be specified with NCM user roles. What you can do is limit the account to these two nodes. Does the device itself support various limitations for different login credentials? If yes, then you could create such credentials on the device and use them as user-level login credentials in NCM.

Jiri

rmverd1

Yes, we use Cisco ACS, but if I limit the account that NCM uses in the background won't that cause other issues? Or are you suggesting I create a new account in NCM for this purpose?

cvachovecj

I think new set of accounts (both device and NCM) would be the safest option.

Jiri

rmverd1

I am having a hard time getting my head around how the web user account in Orion NPM is going to get passed down to the router. Our instance of NCM is integrated with Orion NPM, NTA, and SAM.

NCM uses the "GlobalUsername" account for all NCM tasks executed against nodes, correct? This account and privileges are defined in Cisco ACS, and we tell NCM to use this account to execute NCM tasks. If we limit the "GlobalUsername" account in ACS, won't that limit NCM's ability to perform any config upload/download etc? Is there a way in NCM to create additional "service" accounts? We have an account in ACS that is limited to the commands we want to allow, how to we tell NCM to use this account for certain web users of Orion?

Thanks,

Ron