What is RBAC Role Based Access Control? | What are RBAC Views? | What is the Concept behind Role Based Access Control? | How to configure RBAC on gns3?

 

What is Role-Based Access Control?

RBAC (Role Based Access Control), is also known as Role-Base security. RBAC assigns access permission to users on their role in IT. Only the admin has complete access to the network while the other network engineers do not need full access, some of them just need to monitor and crosscheck the configuration with show commands. Admin can define what user can access as per the user roles.

Why do we need RBAC?

RBAC reduces the risk of cybersecurity and protects against human error, RBAC ensures that admin define users can only access the information and perform actions they need to do as per the role. RBAC is good for large organizations.

What is the Concept behind Role Based Access Control

Admin creates a set of permissions and assigns that permission to the user. For example, user-1 is a junior engineer L-1 and the role is just to monitor interface state. Admin will allow user-1 to only show ip interface brief command to user-1 and now user-1 only access show ip interface brief command not show ip route not configure any and delete anything on the device. Now the security level has been increased because only the admin can configure and delete the configuration.

What are RBAC Views?

Admin creates the Views and views define the commands that a user can access. Mainly we have two types of view. Root view is an admin view where you configure views and superview in this view admin assigns multiple views (users) in superview. Superview can access all the commands that the admin configures the views. Remember these views should be in superview.

(configure the password before configuring any view, if you configure configure then you can lock yourself )

Let's see the topology: https://www.youtube.com/watch?v=D0t29ZdO09I&t=579s

Goal:

• configure  the topology as per the diagram 
• configure the IP addressing as per the topology 
• configure telnet and ensure the computer in our LAN network can access the router. 
• configure root view and password admin and username admin
• configure Parser view user1 and allow ping and show IP int br commands password user1
• configure Parser view user2 and allow show IP int br, show IP route, show IP protocol and trace commands only.
• configure super view and allow user1 and user2 in superview
• ensure computer can access all views 

Router-one-(config)#int fa 0/0
Router-one-(config-if)#ip add 192.168.1.1 255.255.255.0
Router-one-(config-if)#no shutdown
Router-one-(config-if)#exit

Router-one-(config)#int fa 1/0
Router-one-(config-if)#ip address 10.1.1.1 255.255.255.0
Router-one-(config-if)#no shutdown
Router-one-(config-if)#exit

Router-one-(config)#int fa 1/1
Router-one-(config-if)#ip address 192.168.2.1 255.255.255.0
Router-one-(config-if)#no shut
Router-one-(config-if)#exit

*Feb  1 22:20:42.979: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Feb  1 22:20:43.059: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to up
*Feb  1 22:20:43.099: %LINK-3-UPDOWN: Interface FastEthernet1/1, changed state to up

Telnet and ensure the computer in our LAN network can access the router.

Router-one-(config)#line vty 0 15
Router-one-(config-line)#password admin
Router-one-(config-line)#login
Router-one-(config-line)#exit

Router-one-(config)#username admin password admin
Router-one-(config)#exit

Root view and password admin and username admin

Router-one-(config)#aaa new-model

Router-one-(config)#enable secret admin

Router-one-(config)#exit

Router-one-#enable view

Password:

%PARSER-6-VIEW_SWITCH: successfully set to view 'root'.

Router-one-#show parser view

Current view is 'root'

Configure Parser view user1 and allow ping and show IP int br commands password user1

Router-one-(config)#parser view user1

Router-one-(config-view)#secret user1

Router-one-(config-view)#command exec include show ip int br

Router-one-(config-view)#command exec include ping

Router-one-(config-view)#exit

%PARSER-6-VIEW_CREATED: view 'user1' successfully created.

Router-one-(config)#username user1 view user1 secret user1

Router-one-(config)#end

Router-one-#enable view user1

Password:

%PARSER-6-VIEW_SWITCH: successfully set to view 'user1'.

Router-one-#show parser view

Current view is 'user1'

Router-one-#show ip route

                    ^

% Invalid input detected at '^' marker.

Router-one-#traceroute 192.168.1.2

            ^

% Invalid input detected at '^' marker.

(From the above you see user-1 is not able to access show ip route and traceroute command because of admin only two commands to user-1. show ip int br and ping)

Router-one-#show ip int br

Interface                  IP-Address      OK? Method Status                Protocol

FastEthernet0/0            192.168.1.1     YES manual up                    up

FastEthernet1/0            10.1.1.1        YES manual up                    up

FastEthernet1/1            192.168.2.1     YES manual up                    up

Router-one-#ping 192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 20/37/56 ms

configure Parser view user2 and allow show IP int br, show IP route, show IP protocol and trace commands only.

Router-one-(config)#parser view user2

Router-one-(config-view)#secret user2

Router-one-(config-view)#command exec in

Router-one-(config-view)#command exec include show ip int br

Router-one-(config-view)#command exec include show ip route

Router-one-(config-view)#command exec include show ip protocol

Router-one-(config-view)#command exec include traceroute

Router-one-(config-view)#command exec include ping

Router-one-(config-view)#exit

%PARSER-6-VIEW_CREATED: view 'user2' successfully created.

Router-one-(config)#username user2 view user2 secret user2

Router-one-(config)#exit

Router-one-#enable view user2

Password:

%PARSER-6-VIEW_SWITCH: successfully set to view 'user2'.

Router-one-#show parser view

Current view is 'user2'

Router-one-#show ip int br

Interface                  IP-Address      OK? Method Status                Protocol

FastEthernet0/0            192.168.1.1     YES manual up                    up

FastEthernet1/0            10.1.1.1        YES manual up                    up

FastEthernet1/1            192.168.2.1     YES manual up                    up

Router-one-#show ip protocol

Router-one-#show ip route

Gateway of last resort is not set

     10.0.0.0/24 is subnetted, 1 subnets

C       10.1.1.0 is directly connected, FastEthernet1/0

C    192.168.1.0/24 is directly connected, FastEthernet0/0

C    192.168.2.0/24 is directly connected, FastEthernet1/1

Router-one-#traceroute 192.168.1.2

Type escape sequence to abort.

Tracing the route to 192.168.1.2

  1 192.168.1.2 24 msec 40 msec 20 msec

Router-one-#show ?

  bootflash:  display information about bootflash: file system

  disk0:      display information about disk0: file system

  disk1:      display information about disk1: file system

  flash:      display information about flash: file system

  ip          IP information

  parser      Show parser commands

  slot0:      display information about slot0: file system

  slot1:      display information about slot1: file system

Router-one-#show ip ?

  interface  IP interface status and configuration

  protocols  IP routing protocol process parameters and statistics

  route      IP routing table

(From above you see the admin allows user-2 to access only these commands above)

configure super view and allow user1 and user2 in superview

Router-one-(config)#parser view supuser superview

Router-one-(config-view)#secret supuser

Router-one-(config-view)#view user1

Router-one-(config-view)#view user2

Router-one-(config-view)#exit

%PARSER-6-SUPER_VIEW_EDIT_ADD: view user1 added to superview supuser.

%PARSER-6-SUPER_VIEW_EDIT_ADD: view user2 added to superview supuser.

(from the above output you notice we added user-1 and user-2 in superview and now superview can access all the commands that are in user-1and user-2)

Router-one-(config)#username supuser view supuser secret supuser

Router-one-(config)#exit

%PARSER-6-SUPER_VIEW_CREATED: super view 'supuser' successfully created.

Router-one-#enable view supuser

Password:

*Feb  1 22:57:11.823: %PARSER-6-VIEW_SWITCH: successfully set to view 'supuser'.

Router-one-#show parser view

Current view is 'supuser'

ensure the computer can access all views 

Computer#telnet 192.168.1.1

Trying 192.168.1.1 ... Open

User Access Verification

Username: user1
Password:
Router-one->enable view user1
Password:

Router-one-#show ip route
                    ^
% Invalid input detected at '^' marker.

Router-one-#show ip int br

Interface                  IP-Address      OK? Method Status                Prot                                                                                                                                         ocol
FastEthernet0/0            192.168.1.1     YES manual up                    up                                                                                                                                           
FastEthernet1/0            10.1.1.1        YES manual up                    up                                                                                                                                           
FastEthernet1/1            192.168.2.1     YES manual up                    up  

(user-1 allows only two commands ping and show ip int br)