Defining authorization rules using the CLI

Use the commands in this topic to define an authorization rule.

To define an authorization rule:

Go to CLI configuration mode:

cm-hostname > enable
cm-hostname # configure terminal

Define the rule:
```
cm-hostname (config) # aaa authorization access-groups rules rule <operation> <match option 1> [<match option 2>...] grant-access-group <access group name> [comment"<comment>"]
```
where:
- position option specifies the position of the rule in the list. For a description of the possible values, see Rule management options.
- match option specifies the authorization criteria to match. For a description of the possible values, see Authorization rule options.
- access group name specifies the name of the access group.
- comment is an optional comment. Enclose the comment in double quotation marks if it includes more than one word.

Verify your change:

cm-hostname (config) # show aaa authorization access-group rules

Save your change:
```
cm-hostname (config) # write memory
```

Example

The following example creates a rule that grants users in the infosec LDAP group access to the alerts defined for the nx-alerts access group.

cm-05 (config) # aaa authorization access-groups rules rule append tail match-ldap-group infosec grant-access-group nx-alerts

cm-05 (config) # show aaa authorization access-groups rules

#      AAA Authorization Access-groups Rules : Enabled
-----------------------------------------------------------
# Rule        Statements
-----------------------------------------------------------
 # 1           Match LDAP Group                 : infosec
               Grant Access Groups              : nx-alerts

Note

For an examples of a fully configured access group, see Example: configuring an access groups for alerts.