Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets » XXX » Authorization Policy - Local Exceptions
Name Type Constraint Mandatory Default Value authorization_exception_rules List [authorization_exception_rules]No
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d\_\-\. \(\)]+$ Yes state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No profile String No command_sets List String No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWith, macContains, macEndsWith, macEquals, macIn, macNotContains, macNotEndsWith, macNotEquals, macNotIn, macNotStartsWith, macStartsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWith, macContains, macEndsWith, macEquals, macIn, macNotContains, macNotEndsWith, macNotEquals, macNotIn, macNotStartsWith, macStartsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWith, macContains, macEndsWith, macEquals, macIn, macNotContains, macNotEndsWith, macNotEquals, macNotIn, macNotStartsWith, macStartsWithNo attribute_value String No name String No
Example-1 Authorization Exception Rule for DNAC Devices
This example defines an enabled authorization exception rule named “DNACException” within the “Global Policy” device administration policy set. The rule applies to devices identified by the attribute “DNAC” equal to “DNAC Devices” and assigns the “Default Shell Profile” as the authorization profile.
description : Global policy
service_name : Default Network Access
authorization_exception_rules :
type : ConditionAttributes
attribute_value : DNAC Devices
profile : Default Shell Profile
Example-2 Authorization Exception Rule for User3 with DenyAllCommands
This example defines an enabled authorization exception rule named “User3” within the “Global Policy” device administration policy set. The rule applies to TACACS users where the User attribute equals “User3.” It assigns the “Default Shell Profile” and restricts commands using the “DenyAllCommands” command set. The policy set is active with the service name “Default Network Access.”
description : Global policy
service_name : Default Network Access
authorization_exception_rules :
type : ConditionAttributes
profile : Default Shell Profile
Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets » XXX » Authorization Policy - Local Exceptions
Name Type Constraint Mandatory Default Value authorization_exception_rules List [authorization_exception_rules]No
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d_\-\. ]+$ Yes state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No profile String No command_sets List String No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No
authorization_exception_rules :
type : ConditionAttributes
profile : Default Shell Profile
Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets » XXX » Authorization Policy - Local Exceptions
Name Type Constraint Mandatory Default Value authorization_exception_rules List [authorization_exception_rules]No
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d_\-\. ]+$ Yes state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No profile String No command_sets List String No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No
authorization_exception_rules :
type : ConditionAttributes
profile : Default Shell Profile
Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets » XXX » Authorization Policy - Local Exceptions
Name Type Constraint Mandatory Default Value authorization_exception_rules List [authorization_exception_rules]No
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d_\-\. ]+$ Yes state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No profile String No command_sets List String No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No
authorization_exception_rules :
type : ConditionAttributes
profile : Default Shell Profile
