Modifying and deleting rules

The following table describes the tasks you can perform to modify and delete rules. The sections that follow provide examples of some of the tasks.

Important

If you change rule criteria while users are logged in, the changes will take effect after the user logs out and then logs in again. You can view the users who are still logged in after a change has been made, and can forcibly log them out. See Viewing ccess group users using the CLI.

Task	Procedure
Change rule matching criteria values.	Use the `modify <rule number>` rule management command option, and enter the match option with the new value.
Apply an authorization rule to other access groups	Use the `modify <rule number>` rule management command option, and specify the other access group in the `grant-access-group <group name>` command option. If you want to keep existing access groups, you must re-enter them. Otherwise, they will be overwritten.
Add a match option to a rule	Use the `modify <rule number>` rule management command option, and specify the new match option.
Add a comment to an authorization rule	Use the `modify <rule number>` rule management command option, and use the `comment "<comment>"` command option to add the comment. Enclose the comment in double quotation marks if the comment includes multiple words.
Remove a comment from an authorization rule.	Use the `no aaa authorization access-groups rules rule <rule number> comment` command.
Delete authorization rules that are identical to the specified rule.	Use the `aaa authorization access-groups rules rule modify <rule number> dup-delete` command.
Remove matching access group rule criteria.	Use the `no aaa authorization access-groups group <group name> rules rule <rule number> <command option>` command. Include the match option but not the value. NOTE: Do not use the `match-not` command option, even if that command option was used to add the rule criteria. For example, use `match-alert-severity` in this command to remove a criterion that was added using the `match-not-alert-severity` option.
Remove matching authorization group rule criteria.	Use the `no aaa authorization access-groups rules rule <rule number> <command option>`. Include the match option but not the value. NOTE: Do not use the `match-not` command option, even if that command option was used to add the rule criteria. For example, use `match-ldap-group` in this command to remove a criterion that was added using the `match-not-ldap-group` option.
Remove an access group rule.	Use the `no aaa authorization access-groups group <group name> rules rule <rule number>` command.
Remove all access group rules.	Use the `no aaa authorization access-groups group <group name> rules all` command.
Remove an authorization rule.	Use the `no aaa authorization access-groups rules rule <rule number>` command.
Remove all authorization rules.	Use the `no aaa authorization access-groups rules all` command.

Prerequisites

Admin access to the Central Management System appliance

Examples

The following examples illustrate some of the tasks described in the previous table.

Changing rule match option values

The following example changes the appliance name to match in access group rule 3 to nx4500-05.

cm-02 (config) # aaa authorization access-groups group nx-alerts rules rule modify 3 match-appliance-name nx4500-05

The following example changes the LDAP group to match in authorization rule 6 to infosec-hq.

cm-05 (config) # aaa authorization access-groups rules rule modify 6 match-ldap-group infoseq-hq

Applying an authorization rule to other access groups

The following example replaces the access group granted to authorization rule 3 with nx-east.

cm-01 (config) # aaa authorization access-groups rules rule modify 3 match-access-group ex-alerts

The following example uses two match-access-group command options to add the ex-alerts access group to authorization rule 2 and retain the nx-alerts access group.

cm-09 (config) # aaa authorization access-groups rules rule modify 2 match-access-group ex-alerts match-access-group nx-alerts

The following example uses a comma-separated list to add the ex-alerts access group to authorization rule 2 and retain the nx-alerts access group.

cm-09 (config) # aaa authorization access-groups rules rule modify 2 match-access-group ex-alerts,nx-alerts

Adding a match option to a rule

The following example adds a local user match option to authorization rule 3, which is applied to the nx-east access group.

cm-01 (config) # aaa authorization access-groups rules rule modify 3 match-mapped-local-username analyst1

The following example adds an alert severity match option to access group rule 1.

cm-01 (config) # aaa authorization access-groups group nx-alerts rules rule modify 1 match-not-alert-severity minor

Adding or replacing an authorization rule comment

The following example adds a comment to authorization rule 6. If a comment already exists, the command replaces it.

cm-11 (config) # aaa authorization access-groups rules rule modify 6 comment "Eastern region NX alerts"

Deleting duplicates of a specified authorization rule

The following example deletes all authorization rules that are identical to rule 4.

cm-07 (config) # aaa authorization access-groups rules rule modify 4 dup-delete

Removing matching access group rule criteria

The following example removes the match-not-alert-severity minor match criterion from access group rule 11, which is applied to the nx-alerts access group.

cm-05 (config) # no aaa authorization access-groups group nx-alerts rules rule 3 match-alert-severity

Removing matching authorization group rule criteria

The following example removes the match-mapped-local-username analyst1 match criterion from authorization rule 7.

cm-03 (config) # no aaa authorization access-groups rules rule 7 match-mapped-local-username