Checkfailover with Readonly User

[LostBoY]

I am trying to integrate my R80.40 GWs with Cisco ISE.. i am facing problem with Read Only Privilige. i would like read only users to monitor failover status but they cant run show cluster state with monitorOnly Role

how can i get this to work with RO users

[_Val_]

you can create a new role based on MonitorOnly and add additional commands you want those users to run

[LostBoY]

is it possible to clone monitorOnly and add additonal features ? i was looking at monitorOnly rba role and it mentions access to cluster info but when i run it i get an error /bin/cphaprob_start line 6 permission denied

[_Val_]

Role management is described in the Gaia Admin guide. You can create custom roles with certain additional commands for your needs

[LostBoY]

Thanks.. i got certain things to work here.. created a role and added few view commands to it such as ntp, configuration, dns , aaa servers. However , 2 things i cudnt work out.

1) Virtual system access 

2) show cluster state in this custom monitor role

regarding virtual system access i am able to run set virtual-system 2 .. but post that i cannot run any command it keeps throwing this error : supsh0361 failure setting current vrf id

as for the > show cluster state i get this error : /bin/cphaprob_start line 6 permission denied

if i can somehow get these things to work it will be very helpful.

[_Val_]

Check default shell for that account. Some commands will not work from clish and require bash

[LostBoY]

But from adminRole users i can run show cluster state fron GAIA shell itself.. however its not working with custom roles