Is it ever possible to delegate control over a single switch's port to an end user? Here's the situation: let's say a company offers colocation service. Each client's server is connected so a port on a switch. If an user wants to create some rules for this port (for example disable access from specific IP addresses), he has to contact tech support. Are there any ways of delegating user's port (and only this port!) to the user?

  • 4
    I don't know Cisco well enough to say aye or nay, but typically the co-lo provider offers such functionality in their customer portal or API and then pushes a validated config to the switch, rather than give customers direct access to their management network and too much opportunity to screw up. Or they use the opportunity to sell additional services in the form of a firewall appliance... – HBruijn Nov 30 '14 at 14:53

Absolutely. In the TACACS configuration, you can restrict the commands you allow, but you would do better to move that logic into a web application, rather than give your customers direct access into the switches. Simply put, you can create very granular access control using TACACS, but it is very easy to screw-up, and keeping the user-> device -> port -> commands mappings correct in TACACS is harder than keeping it correct in a database-driven application.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.