How to limit NCM access to specific nodes for configuration change?

Hello.

I would go with assigning NCM roles (like "WebDownloader or viewer") to your Orion users: Success Center

I'd also advice to enable the real time change detection in case some one is using SSH outside of Orion and NCM in order to directly log into a device entering commands: Real-time change detection

Best regards,

Steffen

I'd consider to use Custom Properties to create and deploy more limitation for users. It would enlarge the ability of adressed limitation to particular users.

Thanks for your reply, but the roles in NCM is the global configuration which will limit the user to access all / nothing devices, it does not really fit to the requirement what I am having.

Thank you, i tried to group the equipment by using the "Custom Properties" too, it does really limit the network admin for accessing the specific equipment in NCM but it also limit the access of monitoring too.

The situation is

network admin A - NCM to group A devices

network admin B - NCM to group B devices

but network admin A and admin B are able to NPM all group A and group B devices.

Thanks in advance!

I believe what you are trying to do is not possible. The NCM roles are assigned to be valid on all nodes that are in NCM. You can't separate nodes just in NCM and then give permission accordingly.

What you could look at is providing two TACACS credential sets for each Admin Group:

Net Admin 1 = NCMRole1

Net Admin 2 = NCMRole2

So when the NetAdmin 1 tries to execute scripts, if he accidentally tries to run them on devices he doesn't have access to the CLI Credentials used in the script will fail.

To achieve this you would need to change the way NCM is configured to use Individual-level account credentials.