Security access for a switch device
A method for providing user access to a network switch appliance, includes: receiving from a user a request to access configuration item for the network switch appliance, the network switch appliance configured to pass packets received from a network to network monitoring instruments; and determining, using a processing unit, whether to allow the user to access the configuration item for the network switch appliance based on information regarding the user.
1. A network appliance comprising:
a plurality of ports through which to communicate data with devices external to the network appliance, the plurality of ports including a plurality of network ports through which to communicate data with sources and destinations of network traffic, and a plurality of instrument ports through which to communicate data with at least one network instrument; and
a processor configured to
access data indicative of a plurality of access level assignments associated with the network appliance, the plurality of access level assignments including a distinct set of access level assignments for at least two ports of the plurality of ports, each said access level assignment being indicative of an allowed access level, of a plurality of defined access levels, for a particular user to access a particular port of the plurality of ports, each access level of the plurality of defined access levels corresponding to a different set of allowable tasks; and
ascertain whether a particular task associated with a particular port of the network appliance is permitted to be performed by a particular user, based on a corresponding access level of the plurality of access levels.
2. The system of claim 1 , wherein the plurality of ports comprise:
a first network port through which to communicate packets with a first remote device over a network; and
a first instrument port through which to communicate at least some of the packets with a first network monitoring instrument that is external to the network appliance.
3. The system of claim 2 , wherein the first network port is at least one of:
an ingress port through which to receive packets from a source over a network; or
an egress port through which to forward the received packets to a destination over a network.
4. The system of claim 2 , wherein the plurality of ports further comprise a second instrument port through which to communicate at least some of the packets with a second network monitoring instrument that is external to the network appliance.
5. The system of claim 4 , wherein the plurality of ports further comprise a second network port through which to communicate packets with a second remote device over a network.
6. The system of claim 1 , wherein the processor is configured to ascertain whether a share access request is among allowable tasks associated with a user, and to implement the configuration item for the network appliance in response to ascertaining that the share access request is among allowable tasks associated with the user.
7. The system of claim 1 , wherein the network appliance is configured to provide visibility to network parts by operating as a circuit switch.
8. The system of claim 1 , wherein the network appliance is configured to operate as an out-of-band device with respect to a first set of packets and as an in-band device with respect to a second set of packets.
9. The system of claim 1 , wherein the processor is configured to authorize or deny access to a configuration item of the network appliance by a particular user based on an ascertained access level associated with the particular user.
10. The system of claim 1 , wherein each of a plurality of users is enabled to have a different access level to a given port of the plurality of ports of the network appliance.
11. A method comprising:
accessing, by a processor, data indicative of a plurality of access level assignments associated with a network appliance, the plurality of access level assignments including a distinct set of access level assignments for each port of a plurality of ports of the network appliance, each said access level assignment being indicative of an allowed access level, of a plurality of defined access levels, for a particular user to access a particular port of the plurality of ports of the network appliance, each access level of the plurality of defined access levels corresponding to a different set of allowable tasks; and
ascertaining, by the processor, whether a particular task associated with a particular port of the network appliance is permitted to be performed by a particular user, based on a corresponding access level of the plurality of access levels.
12. The method of claim 11 , wherein the plurality of ports comprise:
a network port through which to communicate packets with a first remote device over a network; and
a first instrument port through which to communicate at least some of the packets with a first network monitoring instrument that is external to the network appliance.
13. The method of claim 12 , wherein the network port is at least one of:
an ingress port through which to receive packets from a source over a network; or
an egress port through which to forward the received packets to a destination over a network.
14. The method of claim 12 , wherein the plurality of ports further comprise a second instrument port through which to communicate at least some of the packets with a second network monitoring instrument that is external to the network appliance.
15. The method of claim 14 , wherein the plurality of ports further comprise a second network port through which to communicate packets with a second remote device over a network.
16. The method of claim 11 , further comprising:
ascertaining whether a share access request is among allowable tasks associated with a user; and
implementing a configuration item for the network appliance in response to ascertaining that the share access request is among allowable tasks associated with the user.
17. The method of claim 11 , wherein the network appliance provides visibility to network parts by operating as a circuit switch.
18. The method of claim 11 , wherein the network appliance operates as an out-of-band device with respect to a first set of packets and as an in-band device with respect to a second set of packets.
19. The method of claim 11 , further comprising:
authorizing or denying access to a configuration item by a particular user based on an ascertained access level associated with the particular user.
20. The method of claim 11 , further comprising
enabling each of a plurality of users to have a different access level to a given port of the plurality of ports of the network appliance.