Controlling access to Policy Blocks

This topic includes the following sections:

• Role-based access control for Policy Blocks

• Individual administrator access control for Policy Blocks

Role-based access control for Policy Blocks

FortiManager supports role-based access control (RBAC) for Policy Packages and objects. In order to configure read-only access to Policy Blocks using profiles, an administrator profile must be created with Read-Only permissions for Policy Packages & Objects. This permission level limits the administrator to read-only permissions for all FortiManager policy and object configuration, including Policy Blocks.

For more information on configuring an administrator profile, see Creating administrator profiles and Permissions.

Individual administrator access control for Policy Blocks

You can restrict an individual administrator's access to specific Policy Blocks, and the administrator will only be able to edit, move, and delete those Policy Blocks.

The administrator will be able to view unspecified Policy Blocks in Policy & Objects and in Policy Packages, but will not be able to access, edit, move, or delete them.

To configure an administrator's access to Policy Blocks:

1. Go to System Settings > Administrators and create or edit an administrator.

2. Under Policy Block, you can specify the Policy Blocks that the administrator will have read/write access to.

   • All Policy Blocks: The administrator has access to all Policy Blocks.

   • SpecifyThe administrator will only have access to the specified Policy Blocks. The administrator can see that unspecified Policy Blocks exist and can see them in Policy Packages, but they cannot be edited, moved, or deleted.

     Only Policy Blocks in ADOMs to which the Administrator has access are displayed in the Specify list.

3. Click OK to save the administrator.

Example of specifying administrator access to Policy Blocks:

1. In an ADOM , two Policy Blocks have been configured: PB1 and PB2.
   

2. An new administrator is configured with permissions to allow management for two Policy Packages and Policy Block PB1.
   

3. In Policy & Objects > Policy Packages, the administrator can see the Policy Packages and both Policy Blocks, but only has edit/move/delete permissions for PB1.
   

   

4. The administrator can see that Policy Block PB2 exists in the Policy Package, but cannot edit, add, or remove it.