config system accprofile
Use this command to manage access profiles.
Access profiles provision permissions to roles. The following permissions can be assigned:
- Read (view access)
- Read-Write (view, change, and execute access)
- No access
When an administrator has only read access to a feature, the administrator can access the web UI page for that feature, and can use the get and show CLI command for that feature, but cannot make changes to the configuration.
In larger companies where multiple administrators divide the share of work, access profiles often reflect the specific job that each administrator does (“role”), such as account creation or log auditing. Access profiles can limit each administrator account to their assigned role. This is sometimes called role-based access control (RBAC).
Table 20 lists the administrative areas that can be provisioned. If you provision read access, the role can view the web UI menu (or issue a CLI get command). If you provision read-write access, the role can save configuration changes (or issue a CLI set command).
For complete access to all commands and abilities, you must log in with the administrator account named admin.
| Web UI Menus | CLI Commands |
|---|---|
|
System |
config system diagnose hardware diagnose netlink diagnose sniffer diagnose system execute date execute ping execute ping-options execute traceroute |
|
Networking |
config router |
|
Server Load Balance |
config load-balance |
|
Link Load Balance |
config link-load-balance |
|
Global Load Balance |
config global-dns-server |
|
Security |
config firewall |
|
Log & Report |
config log execute formatlogdisk |
|
* For each |
|
Before you begin:
- You must have read-write permission for system settings.
Syntax
config system accprofile
edit <name>
set firewall {none|read|read-write}
set global-load-balance {none|read|read-write}
set link-load-balance {none|read|read-write}
set load-balance {none|read|read-write}
set log {none|read|read-write}
set router {none|read|read-write}
set security {none|read|read-write}
set system {none|read|read-write}
next
end
|
firewall |
Set the permission:
|
|
global-load-balance |
Set the permission:
|
|
link-load-balance |
Set the permission:
|
|
load-balance |
Set the permission:
|
|
log |
Set the permission:
|
|
router |
Set the permission:
|
|
security |
Set the permission:
|
|
system |
Set the permission:
|
Example
FortiADC-docs # config system accprofile
FortiADC-docs (accprofile) # edit doc-user
Add new entry 'doc-user' for node 772
FortiADC-docs (doc-user) # get
system : none
router : none
firewall : none
load-balance : none
log : none
link-load-balance : none
global-load-balance : none
security : none
FortiADC-docs (doc-user) # set system read-write
FortiADC-docs (doc-user) # end