Skip to main content

Command Sets

A command set is a reusable list of permit/deny rules for CLI commands. You build them here, then assign them to people in User Policies.

Create a command set​

  1. Go to Device Admin (TACACS+) → Command Sets → New.
  2. Name it for the role it represents (e.g. NOC read‑only, Network admins → full access).
  3. Add rules — each rule is:
    • command — the CLI command, e.g. show, configure, or * for all commands.
    • args regex (optional) — match specific arguments (e.g. only show run vs all show).
    • permit or deny.
  4. Set the Default action — what happens to a command that matches no rule in this set (permit or deny).
  5. Save.

Examples​

  • NOC read‑only → permit show *, default deny → operators can look but not change.
  • Network admins → permit *, default permit → full access.
  • Restricted → permit show *, deny configure *, default deny.
tip

Order matters within a set — put specific deny rules above a broad permit so an exception (e.g. deny configure) wins over the general allow.