I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch.

Note, I am not trying to control access FROM a VRF.

We have an ACS server so if it can't be done with access-class or other commands on the switch itself, I'm wondering if it would be possible to limit access to config commands within a specific VRF. As I write this, I don't think this would really be possible as you can configure an interface that's in a specific VRF without specifying the VRF.

The reason I'm asking is we are going to connect to our parent company's WAN using a VRF on our core switch. However, they're saying they need access to whatever equipment they will be peering with.

I'm not so worried about the show commands. It's more the configuration commands.

If not, we'll just have to count on our logging to let us know something's been changed.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14 '17 at 21:16

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's all they need.

  • Thanks Ron. I'm also thinking there's really no way to limit to a specific VRF either, even with ACS since the RF modifiers are in the middle of the commands and their position tends to change depending on the command. They do want config access because they want to troubleshoot and configure routing back to the WAN. Luckily both rancid and SolarWinds send emails when something changes.
    – RSS
    Jul 13 '16 at 17:09

Just to close this out, I worked with Cisco support to configure ACS to limit their access as much as possible but they did confirm that you cannot limit access to a VRF.

I also asked them if I could allow access to all commands in a particular mode using Cisco ACS (i.e. everything under config-if) and the answer was no to that one too. The guy said you need to put the start of the command in and wildcard it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.