I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch.
Note, I am not trying to control access FROM a VRF.
We have an ACS server so if it can't be done with access-class or other commands on the switch itself, I'm wondering if it would be possible to limit access to config commands within a specific VRF. As I write this, I don't think this would really be possible as you can configure an interface that's in a specific VRF without specifying the VRF.
The reason I'm asking is we are going to connect to our parent company's WAN using a VRF on our core switch. However, they're saying they need access to whatever equipment they will be peering with.
I'm not so worried about the show commands. It's more the configuration commands.
If not, we'll just have to count on our logging to let us know something's been changed.