Scope

Scopes are a Role-Based Access Control (RBAC) construct in SD-WAN Manager, managed under Administration > Users and Access. A scope groups together configuration objects such as configuration groups, feature profiles, device templates, feature templates, localized policies, security policies and network hierarchy nodes (groups, regions and sites), so that the users assigned to the scope are only able to see and operate on the objects contained in it.

Scopes require SD-WAN Manager version 20.15.0 or later. Each object type is expressed in the data model as its own list of object names, and the referenced objects are resolved to their identifiers in SD-WAN Manager when the scope is created.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
scopes	List	scopes	No

scopes (sdwan)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	Yes
description	String		No
configuration_groups	List	String[Regex: ^[^&<>! "]{1,128}$]	No
edge_device_templates	List	String[Regex: ^[^&<>! "]{1,128}$]	No
edge_feature_templates	List	String[Regex: ^[^&<>! "]{1,128}$]	No
feature_profiles	List	String[Regex: ^[^&<>! "]{1,128}$]	No
localized_policies	List	String[Regex: ^[^&<>! "]{1,128}$]	No
network_hierarchy_nodes	List	String[Regex: ^[^&<>! "]{1,128}$]	No
security_policies	List	String[Regex: ^[^&<>! "]{1,128}$]	No
users	List	String[Regex: ^[^&<>! "]{1,128}$]	No

Examples

Example-1: This example demonstrates a scope that grants a set of operators access to a complete configuration stack, combining both the configuration group based objects (configuration groups and feature profiles) and the classic template and policy based objects, as well as the network hierarchy nodes the team is responsible for, together with the users that are assigned to the scope. It also references Global, the built-in root of the network hierarchy.

sdwan:
  scopes:
    - name: emea_operations
      description: emea operations team scope
      configuration_groups:
        - cg1
      edge_device_templates:
        - dt1
      edge_feature_templates:
        - ft1
      feature_profiles:
        - system1
        - transport1
      localized_policies:
        - lp1
      network_hierarchy_nodes:
        - Global
        - emea_region
        - SITE_101
      security_policies:
        - sp1
      users:
        - demouser1

Example-2: This example demonstrates a minimal scope that only limits access to a single configuration group. Users are assigned to the scope later, so only the scope name and the object it contains are configured.

sdwan:
  scopes:
    - name: branch_readonly
      configuration_groups:
        - cg2

Note: The configuration groups, feature profiles, device templates, feature templates, localized policies and security policies referenced by a scope must be defined elsewhere in the data model, otherwise the scope cannot be created. network_hierarchy_nodes is the exception: it may name any site, group or region that exists on SD-WAN Manager, whether or not it is declared under sdwan.network_hierarchy. Nodes that are not declared in the data model are looked up on SD-WAN Manager by name, and a name that exists neither in the data model nor on SD-WAN Manager fails the plan. This includes Global, the built-in root of the network hierarchy, which is created by SD-WAN Manager itself and therefore cannot be declared under sdwan.network_hierarchy; referencing it in network_hierarchy_nodes scopes the users to the entire network hierarchy. The only objects SD-WAN Manager associates on its own are the feature templates that compose a referenced device template; no feature profile is ever added automatically, not even when the scope references a configuration group that contains it. If the users of the scope need access to the policy objects, the policy object profile must therefore be listed explicitly under feature_profiles.

Note: A user can be assigned to only one scope. SD-WAN Manager stores a single scope per user.